How to implement SSO using Identity Server?

Question

I have a number of legacy .NET Framework web apps that use .NET Membership and Forms Authentication. They each have their own login pages but they are all on the same domain (e.g. .mycompany.com), share an ASP.NET Membership database and share a machine key so they are able to recognize each other's cookies to achieve SSO; i.e. if you log into one app then you're logged into them all, same with logging out.

Now I want all future apps to be developed in .NET Core and use a common Identity Server as a centralized authentication mechanism. I have a simple Identity Server up and running as well as a couple different flavors of .NET Core client apps. All this works great. The hurdle I can't seem to get over is SSO among all the mycompany.com apps. Brock Allen recommended here that I take a look at the client samples for inspiration.

The MVC OWIN Client (Implicit) sample gets me most of the way there. I'm able to port my legacy apps over to use OWIN cookie authentication and OIDC, but it's not true SSO. Currently, if I log into app1.thirdparty.com, then I am redirected to identityserver.mycompany.com for authentication. After I login to identityserver.mycompany.com then I gain access to app1.thirdparty.com, which is great, but I also have to do this same process for each of the mycompany.com apps. Granted I don't have to enter my credentials each time because I already have a session established with identityserver.mycompany.com but I still have to go to each app and click the login button before I'm officially logged in. I'd prefer that logging into identityserver.mycompany.com initiate SSO with all of my other apps within the mycompany.com domain. Similarly, if I am already logged in to the mycompany.com apps then I'd like identityserver.mycompany.com to be aware of that and not require me to enter my credentials again.

Is this possible? How would I go about it?

Answer 1

This article had exactly the information I was looking for. Microsoft.Owin.Security.Interop provides the shims you need to get this to work.