Hi Matt,
Yes, we have implemented the pass-through feature but we have decided that using a cookie instead of a querystring will be better as this way FileVista can detect when the user logs out from the external application. I have sent you the updated files and I am waiting for your feedback on this new feature.
For making use of this feature, first you need to edit App_Data\FileVista.config and add this line:
<add key="ApplicationKey" value="dsfd4ee3ytg3" />
This is the secret key used for hashing the information that is passed to FileVista. This way FileVista will verify that the automatic login request is coming from a trusted source and is not altered by 3rd parties. You should better set the value to a complex string.
Secondly, you will set a special cookie within the external application which can be ASP.NET, ASP or any other kind of script as long as it's on the same domain.
ASP.NET C# code:
Response.Cookies["FileVistaLoginCookie"]["user"] = userName;
Response.Cookies["FileVistaLoginCookie"]["hash"] = MD5Hash(userName + applicationKey);
Response.Cookies["FileVistaLoginCookie"].Path = "/";
ASP Code:
Response.Cookies("FileVistaLoginCookie")("user") = userName
Response.Cookies("FileVistaLoginCookie")("hash") = MD5Hash(userName + applicationKey)
Response.Cookies("FileVistaLoginCookie").Path = "/"
Note that userName is the name of the user that the external application authenticated. MD5Hash is your function that returns MD5 hash of userName string plus applicationKey string which should be the same key as set in FileVista.config. If using ASP.NET, you can reference GleamTech.Utility.dll in your application and use our CryptoManager.Hash() function for this purpose, there are also ASP versions for MD5 hash on the net.
Be careful about setting the Path property of the cookie as it effects the accessibility. For instance, if your domain is www.mydomain.com, the value of "/" (root) will make the cookie available to all sub-urls like www.mydomain.com/Filevista/ or www.mydomain.com/SomeFolder/FileVista. Or you can limit the cookie just to the folder of FileVista like "/Filevista" or "SomeFolder/FileVista".
It's recommended that you include the above code for adding the cookie in your external application's login/authenticate module where you just authenticate the user and start his session. In the same way, you should include the below code for removing the cookie in your application's logout function:
ASP.NET C# code:
Response.Cookies["FileVistaLoginCookie"].Expires = DateTime.Now.AddDays(-1);
ASP Code:
Response.Cookies("FileVistaLoginCookie").Expires = Date() - 1
After you complete the above integration, you can include a link in your external application which simply targets to "FileVista/" or "FileVista/default.aspx". FileVista will detect the cookie set by your application and automatically log the user in without displaying the login page.
Regarding your other question, you can encrypt the passwords by referencing GleamTech.FileVista.dll and using FileVistaUser.CreateSalt() and FileVistaUser.CreateHash() functions:
byte[] passwordSalt = FileVistaUser.CreateSalt();
parameter = command.Parameters.Add("@Password", OleDbType.Binary, 16);
parameter.Value = FileVistaUser.CreateHash(password + Convert.ToBase64String(passwordSalt));
parameter = command.Parameters.Add("@PasswordSalt", OleDbType.Binary, 16);
parameter.Value = passwordSalt;