Microsoft Media Platform + Forms Authentification

Question

Forms Authentication does not work. Auth cookies are not sent to server when SMF attempts to get access to *.ism/Manifest files on a server that requires specific user roles.

What i do: 1. Create new Silverlight Smooth Streaming template with supporting RIA WCF. 2. Configure web.config :

<connectionStrings>
<add name="ApplicationServices" connectionString="Data Source=[SERVER];Initial Catalog=[CATALOG];User ID=[USER];Pwd=[PASSWORD];" providerName="System.Data.SqlClient" />

<system.web>
      <authentication mode="Forms">
        <forms loginUrl="~/Account/LogOn" timeout="2880" />
      </authentication>
      <membership>
        <providers>
          <clear />
          <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/" />
        </providers>
      </membership>
      <profile>
        <providers>
          <clear />
          <add name="AspNetSqlProfileProvider" type="System.Web.Profile.SqlProfileProvider" connectionStringName="ApplicationServices" applicationName="/" />
        </providers>
        <properties>
          <add name="Gender" />
          <add name="Birthday" />
          <add name="AvatarPath" />
        </properties>
      </profile>
      <roleManager enabled="true">
        <providers>
          <clear />
          <add connectionStringName="ApplicationServices" applicationName="/" name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" />
            <add applicationName="/" name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" /> 
        </providers>
      </roleManager>

1. Add Authentification Service and correct User class (add 3 props).
2. On client side add this to app.xaml.cs:

     public App()
     {
     //Default things...
     InitializeWebContext();
     }

    private void InitializeWebContext()
    {
        WebContext webContext = new WebContext();
        var fa = new FormsAuthentication();
        var ac = new AuthenticationDomainService1();
        fa.DomainContext = ac;
        fa.Login(new LoginParameters("user", "password"), (y) =>
                                                                    {
                                                                        if (!y.HasError)
                                                                        {
                                                                            this.RootVisual = new MainPage();
                                                                        } 
                                                                    }, null);
        webContext.Authentication = fa;
        ApplicationLifetimeObjects.Add(webContext);
        Resources.Add("WebContext", WebContext.Current);
    }

Access is restricted by web.config file in target directory:

    <?xml version="1.0" encoding="UTF-8"?>
    <configuration>
        <system.web>
            <authorization>
            <allow roles="Role_name" />     
            <deny users="*" />                                      
            </authorization>
        </system.web>
    </configuration>

User exists in this role.

When I use the default video that's specified in Xaml (Big Bunny) - everything is fine. But when I change mediasource to a path to s restricted zone on my server I get an access error. On the client side, I get user credentials succesfully.

Fiddler shows next thing: When I try access to another resctricted methods ([RequiresAuthentication]) on RIA WCF, client send Auth cookies, but when SMFPlayer try access to media source, that cookie wasn`t sent.

What have I missed?

Answer 1

I found some workaround: If you transfer the stream files into a subdirectory, and restrict access to it (instead of a directory with "ism" files). Manifest will be issued to anonymous users, but the data streams is only for registered (when player try touch data stream it sucessfully attach auth cookies).