Configure Claim based identity for multiple applications in localhost

Question

I have two applications "http:/localhost/applicationA" and "http:/localhost/applicationB". I have configured applicationA for claim based authentication settings. applicationA is working perfectly. But I am refering some javascrips of applicationB from applicationA. But applicationB has no the authentication cookies(FedAuth).

Is it possible for me to add claim authentication in both applicationA, applicationB using the below code?

<system.identityModel>
<identityConfiguration>
  <audienceUris>
    <add value="http://localhost/applicationB/" />
    <add value="http://localhost/applicationA/" />
  </audienceUris>
  <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
    <authority name="PassiveSigninSTS">
      <keys>
        <add thumbprint="DE161DD37B2FEC37BDB17CAFF33D982DCE47E740" />
      </keys>
      <validIssuers>
        <add name="PassiveSigninSTS" />
      </validIssuers>
    </authority>
  </issuerNameRegistry>
  <!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
  <certificateValidation certificateValidationMode="None" />
</identityConfiguration>

Lontson

Answer 1

You would need to enable claims authentication in applicationB for this to work. In other words, you would need to setup the same system.identityModel web.config settings in applicationB as in applicationA (as you've shown in your example).

Is there a reason that the JavaScript needs to be secured? If the scripts aren't secured, why not just make them accessible to everyone so you won't need to worry about the single sign-on across sites?

Milkwort

Thank you for your valid informations. About the script I have added the scripts on a folder inside localhost/Scripts. Then this scripts are not authorised. because I have added the system.identityModel web.config settings in applicationA. So the scripts are not authorised. it shows the 401 error message. not authorised. – Lontson

I'm a little unclear. So the scripts are in applicationB, correct? Is this a Web Forms or MVC application? Do the scripts need to be secured? If not, you can allow anonymous access to the scripts so there won't be a problem. – Milkwort

No. scripts are in "localhost/Scripts" The applications are localhost/applicationA and localhost/applicationB........... Then scripts have error message as 401. Because I have configured only in localhost/applicationA. – Lontson

So it sounds like you would need to do as I suggested: you would need to add the system.identityModel configuration information into the web.config for the other application. – Milkwort

Thank you so much. But how can I make a webrequest from applicationA toapplicationB. while I make the request, I got the response as login page to the STS server. applicationB always redirect to the STS server for token. No reuse of token here. – Lontson

@GarrettVlieger did anyone of you resolve the problem of the last comment? I have the same issue, please if you can provide any samples of the config files it will be helpful. I have two applications(A and B), A takes the token from the STS and when the user is authenticated I want to redirect that user with the token to the website B. – Ashton