ASP.NET Authentication - One login system for multiple apps

Question

We have a server with lets say 5-10 internal ASP.NET (MVC) applications running in separate application pools as separate websites (on different ports and/or subdomains). I know nothing about the built-in ASP.NET authentication framework, so I was wondering if anyone could drop me a quick pointer in the right direction...

I want to secure all of the internal apps via one login mechanism (supporting 3-5 different roles; nothing complex). This login system would be another app/website running on the server, and to gain access to any other app, one must have authenticated via the one login system and the target app must be able to see the user's role. The internal apps will be modified at the code level to plug into this new login system (in other words, we'll modify the current apps to support the authentication).

The whole point of this is that I don't want each app to have its own login/authentication mechanism, but rather use a more "global" authentication system (everything on the same server). I am not looking for anything complex (just a company of 15-25 employees, 3-5 departments - each user must be associated with a department (role) based on their login - and each app will be tuned to show the user the appropriate data based on his role).

The question is - how do I make it so that a user's authentication status is visible across all of the different apps (in different assemblies and running separately)?

Do I need to use Forms authentication? Or something in Spring.NET?

Answer 1

Single sign-on is relatively easy to achieve within a subdomain or second-level domain. ASP.NET Forms Authentication is a ticket based system where the ticket is stored encrypted in a cookie. What you must achieve is to enable your web apps to share a this cookie.

For a subdomain scenario (e.g. mysite.com/app1, mysite.com/app2), just set the encryption/decryption keys to be the same in machinekey setting in web.config files.

For a second-level domain scenario (e.g. app1.mysite.com, app2.mysite.com), in addition to the above, you need to make some code change to force all authentication cookies to use the same top level domain (e.g. mysite.com).