Single Sign On with Forms Authentication

Question

I am trying to set up Single sign on for 2 websites that reside on the same domain

e.g.

http://mydomain (top level site that contains a forms-auth login page)

http://mydomain/admin (seperately developed website residing in a Virtual Application within the parent website)

Have read a few articles on Single Sign on e.g.

http://www.codeproject.com/KB/aspnet/SingleSignon.aspx

http://msdn.microsoft.com/en-us/library/dd577079.aspx

And they seem to suggest it is just a case of having the same machinekey section in each web.config so that the cookie encryption and decryption is the same for each application

I have set this up and I never get prompted for credentials in the sub-website (the virtual application)

I always get prompted in the parent site.

In addition to having the same machinekey I've also tried adding the same <authentication> and <authorisation> elements

Any idea what I could be missing?

Cuthbert

Any sucess with this question? – Putrescent

Answer 1

I had used <clear/> on the httpModules section, as there were items in the parent that did not exist in the bin dir for the child (/admin)

In doing so (using <clear/> that is ) I had inadvertently cleared the FormsAuthentication module specified in the web.config in C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG

so i needed to re-add those explicitly to the child (/admin) config

Cuthbert

I am trying to do something similar. Can we have Forms AuthN and SSO for the same website? Perhaps have two different start page, but single web.config? Any comments, suggestions? – Pyrrhonism

Answer 2

Your forms section of web.config needs to be the same as well.

Quote from - Forms Authentication Across Applications

To configure forms authentication across applications, you set attributes of the forms and machineKey sections of the Web.config file to the same values for all applications that are participating in shared forms authentication.

The following example shows the Authentication section of a Web.config file. Unless otherwise noted, the name, protection, path, validationKey, validation, decryptionKey, and decryption attributes must be identical across all applications. Similarly, the encryption and validation key values and the encryption scheme and validation scheme used for authentication tickets (cookie data) must be the same. If the settings do not match, authentication tickets cannot be shared.

Modestamodeste

thanks - as I said earlier, I have tried with the same authentication and authorisation sections OPne interseting thing I have noticed is that when I use a fully qualified path for the loginURL e.g. "mydomain/login.aspx" I get prompted for Windows Credentials (not the forms login page I would expect) – Cuthbert

Just want to make sure i get this right. If you log into Mydomain you should be authenticated for Mydomain/admin and this works fine. And you want it to work the other way round as well? i.e. when you log into admin your authenticated for Mydomain? Have you taken a look at your authentication code in MyDomain? Does it somehow differ from /admin? – Modestamodeste

No. When I visit mydomain, which contains the login page, I would like to be authenticated for mydomain and also mydomain/admin. When I visit mydomain, I get redirected to the login page - which is what I want to happen. When I visit mydomain/admin, I don't get redirected - I have full access to the /admin site. i.e. it's not picking up the authentication from the parent – Cuthbert

Answer 3

Try configuring the httpCookies section in the web.config of both applications to use the same domain. That way when you log-in to one app the FormsAuthentication cookie you get will be visible to the other application.

Eous

thanks for the suggestion - unfortunately that hasnt made any difference – Cuthbert

Answer 4

You need to have the same authentication elements in the web.config. In the contained forms element, make sure you give each application the same value for the name attribute. For the loginUrl attribute, I use a relative path and use the same logon page for all of the applications (e.g. loginUrl="/MainApp/login.aspx").

Also, are you creating the authentication ticket manually?

Drumhead

yes, have tried with a local path (login.aspx) in the parent, and a full path (mydomain/login.aspx) in /admin, but I never get redirected to the login page on /admin. If I put a full path in both then I get promted with a windows login prompt (not forms page login). have tried all security setting in IIS but can't get redirected to the login page on the child site – Cuthbert

Are you trying to display the logon page even when the user has already logged on to the non-admin site? Also, are you putting the restrict users section in the authorization element? – Drumhead

Answer 5

There is a breaking change in ASP.NET 4.5's token generation

If you're mixing ASP.NET 4.5 apps with apps targeting earlier versions, you will need to ensure compatible tokens are used everywhere. Add this attribute to the <machineKey> on any site targeting .NET 4.5 or higher:

<system.web>
  <machineKey compatibilityMode="Framework20SP2" /> 
</system.web>

See this answer for more details. Special thanks to this comment which pointed me in the right direction.

Authorize