DomAuthSessId, cookies, iframe and POST authentication

HCL Domino Domino Forum
1

This post is a bit long, but hopefully someone can stomach my ramblings and might get to the end!!

I am trying to POST a ?login authentication to a Domino server from a different platform\ application and have this redirected to another url. I will know the login credentials prior to the login. I am not involved in the portal side, only Domino. I have successfully tested all the separate pieces, but can’t put them together.

Within the body of the main web portal page, will be a series of tabs, which when clicked will load an iframe, one of these being application on a Domino server, which requires authentication. SSL is enabled. I could just set the src=“http://yupodc2/names.nsf?login&username=my+name&password=12345678&redirectto=http://yupodc2/projects/tpmwebportal.nsf/frmRedirect?openform&ATGSESSIONID=abcdefgh”, but, even though it is SSL enabled, the user name and password will still be logged in the Domlog.nsf.

The other method I have been testing is, the portal will authenticate with the Domino server using the org.apache.commons.httpclient classes, to obtain the Domino session ID “DomAuthSessId” from the returned cookie. I developed this in Eclipse and have tested this successfully, but as specified in the documentation, you may not perform a redirect.

If I then start firefox, check all cookies have been cleared, then using Web Developer\ Cookies\ Add cookie (Firefox add in)… set the Name=DomAuthSessId, value=dom session ID returned by server, host=yupodc2, Path=/, I can then set my iframe src=“http://yupodc2/projects/tpmwebportal.nsf/frmRedirect?openform” and it will load without authentication prompt. I don’t need to pass the username and password, since the DomAuthSessId matches to a user name. I have tested this successfully in Firefox, not in IE, I don’t know how to manually set a cookie in IE…see below.

There is the an issue with 3rd party cookies in the browser, since the iframe src might not be in the same domain as the portal domain, but all browsers will be set to accept the SSL certificate (I am testing with a selfcert.kyr on my server) and cookies.

Setting cookie problem:

In my portal (I have a dummy portal for testing), I have put a button with the following javascript code, I am unsuccessfully trying to set a cookie - no javascript errors:

function createCookie(name,value,days) {

if (days) {

	var date = new Date();

	date.setTime(date.getTime()+(days*24*60*60*1000));

	var expires = "; expires="+date.toGMTString();

}

else var expires = "";



//NAME=VALUE; expires=DATE;path=PATH; domain=DOMAIN_NAME; secure



//  ONE

//var cookie_string=name + "=" + value + expires + ";path=/;";



//  TWO

var cookie_string=name + "=" + value + expires + ";path=/;host=yupodc2";



//  THREE

//var cookie_string=name + "=" + value + expires + ";path=/;domain=yupodc2";



document.cookie = cookie_string;

alert("...createCookie()...[" + cookie_string + "]");

}

ONE : will set a cookie, but with no domain or host, so it is not recognised. If I run this in IE, it sets the Domain to local.

TWO : as above

THREE : does not set the cookie at all

Phew.

I would be very grateful for any guidance\ comments\ advice on any of the following:

(A) am I going about this whole problem incorrectly.

(B) POST login and redirect.

(C) Setting cookies via javascript - how to set the domain\ host.

Thanks in advance,

Nick

2

Subject: DomAuthSessId, cookies, iframe and POST authentication.

I can offer some advice as I’ve done this type of thing before. I don’t think you are going about it the wrong way, seeing your circumstances. I’d make sure you are using some JS code like this to set the cookie.

function setCookie(name, value, expires, path, domain, secure) {

var curCookie = name + “=” + escape(value) +

  ((expires) ? "; expires=" + expires.toGMTString() : "") +

  ((path) ? "; path=" + path : "") +

  ((domain) ? "; domain=" + domain : "") +

  ((secure) ? "; secure" : "");

document.cookie = curCookie;

}

Something to look out for in IE when it comes to third party cookies is P3P … perhaps IE is blocking your cookie. Check out link for more information.

HTH

Patrick

3

Subject: RE: DomAuthSessId, cookies, iframe and POST authentication.

@Patrick, thanks for your response. I found out, once I had read about cookies properly, you can not set the domain to another domain. So if my main frame is abcd.com and I try and set my cookie’s domain to acme.com…you cannot do this.