Get Method
When the Get method is used, the submitted user ID and password are placed in the HTTP header and are available to the AuthFilter when it receives the SF_NOTIFY_PREPROC_HEADERS event. This occurs before the login page processes the request.
The following steps are taken:
The AuthFilter retrieves the submitted user ID and password from the QueryString collection properties, txtUserName and txtPassword.
The AuthFilter checks the local password cache for an entry matching the user ID.
If an entry is found, the password is updated with the submitted password.
If an entry is not found, a new entry is made using the submitted user ID and password.
The AuthFilter returns processing to the login page.
In the login page, the submitted user ID and password are retrieved from the txtUserName and txtPassword properties of the QueryString collection of the Request object.
Using the submitted user ID, the profile of the user is retrieved from the Commerce Server Profiles resource or another profile system.
If the user does not have a profile, the user is redirected to the registration page.
If the user has a profile, but the password associated with the profile does not match the submitted password, the login page is resent to the user.
If the passwords do match, the AuthManager object is used to set the MSCSAuth ticket into a session cookie for the user.
The user is redirected to the original URL, which was previously stored by the AuthFilter in the MSCSFirstRequestedURL property of a separate session cookie.
When the browser resubmits the request, the AuthFilter determines the ticket is valid and returns processing to IIS.
If the user has access rights to the URL, it is returned.