Forms Authentication ReturnUrl and subdomain for single sign-on

Question

I have a domain http://abc.com and a subdomain http://sub.abc.com. I'm implementing single sign-on between the two sites by sharing the forms authentication cookie. This is implemented by having both sites share the validationKey and decryptionKey in the machineKey.

When the user hits a page in the subdomain I want the user authenticated in the root domain and redirected back to the subdomain. The user is redirected to the login page currently but the ReturnUrl wants to redirect to the root site.

Eg. Currently: http://abc.com/login.aspx?ReturnUrl=%2fsecure%2fdefault.aspx

but I want: http://abc.com/login.aspx?ReturnUrl=http:%2f%2fsub.abc.com%2fsecure%2fdefault.aspx

How can this be achieved?

In my subdomain's web.config I have the auth configured like this currently:

<authentication mode="Forms">
  <forms name=".ASPNET" loginUrl="http://abc.com/login.aspx" protection="All" timeout="1440" path="/" domain="abc.com" enableCrossAppRedirects="true" />
</authentication>

Answer 1

I solved this by setting a querystring in my forms element from my subdomain:

<authentication mode="Forms">
    <forms name=".ASPNET" loginUrl="http://abc.com/login.aspx?returnsite=sub" protection="All" timeout="1440" path="/" domain="abc.com" enableCrossAppRedirects="true" />
</authentication>

Then in my auth code in my main website, I check for that querystring. If it exists I build the redirect url by appending my subdomain to the returnurl.

That returnsite querystring is really only acting as a flag that I need to redirect to a known subdomain else it will work with just the redirecturl to the current domain. This should (in theory) prevent cross site scripting.