Classic ASP and ASP.Net Authentication

Question

I have two separate applications (one is the classic asp, the other is asp.net), which, from the point of view of the user, should look smoothly like one "application". As others noted, these two applications cannot transmit session information, so I plan to use Windows authentication on these lines: -

In the ASP world:

Request.ServerVariables("AUTH_USER")

and in ASP.Net (.Net 2.0):

System.Threading.Thread.CurrentPrincipal.Identity.Name

which is called from my business logic level (i.e.

HttpContext.Current.User.Identity.Name

unavailable to me).

Is this considered good practice or is there a better way? What do I need to consider when configuring IIS?

Answer 1

, , , .

http://weblogs.asp.net/scottgu/archive/2007/03/04/tip-trick-integrating-asp-net-security-with-classic-asp-and-non-asp-net-urls.aspx

, , . .