Asp.net forms authentication and multiple domains

by

What you’re after is a Single Sign-on solution.

As ASP.NET authentication is at it’s heart generally cookie based, there are two things to look at:

  1. Set your cookies correctly.
  2. Bounce your users to the alternative domain during signup.

Looking at both of these in more depth:

1. Setting cookies correctly

You need to ensure that ASP.NET is writing the authentication ticket cookies to the root domain, rather than the explicit domain this is done using the domain attribute of the forms element:

<forms 
   name="name" 
   loginUrl="URL" 
   defaultUrl="URL"
   domain=".example.com">
</forms>

You should set your domain to “.example.com” – note the leading period – this is the key. This way requests to example.com and www.example.com will both read the cookie correctly, and authenticate the user.

2. Bounce users to the alternative domain

What we have implemented on a few sites that use a single sign on is a round trip login process. The user authenticates on the first domain, we encrypt the login details, and redirect them to a known page on the second domain, log them in there, and then redirect back to the original server.

This client side redirection is important – cookies are only written when there is a response back to the client, and the browser has to visit the second domain to actually see the cookies.

Other details to consider in this sort of set-up:

  1. You probably want to have a timeout on the encrypted sign-in details – so that recalling that URL from the browser history doesn’t automatically log the user in.
  2. If the domains are on different servers, you will need to ensure that either the machine keys are configured the same, so that you can encrypt and decrypt the details correctly, or use some other shared key.
  3. You will probably want to have a mechanism in place to recall the users ReturnUrl from the original server so that you can send them back to the correct place.

You could also take a look at “Forms Authentication Across Applications”

More Related Contents:

  1. ASP.NET MVC – Set custom IIdentity or IPrincipal
  2. Can some hacker steal a web browser cookie from a user and login with that name on a web site?
  3. FormsAuthentication.SignOut() does not log the user out
  4. Mixing Forms authentication with Windows authentication
  5. Passing FormsAuthentication cookie to a WCF service
  6. Store/assign roles of authenticated users
  7. How to remove returnurl from url?
  8. Forms Authentication Ignoring Default Document
  9. Impersonate using Forms Authentication
  10. Allow access for unathenticated users to specific page using ASP.Net Forms Authentication
  11. Forms authentication: disable redirect to the login page
  12. Can I change the FormsAuthentication cookie name?
  13. Different users get the same cookie – value in .ASPXANONYMOUS
  14. Disable browser’s back button
  15. How to implement multiple searching in jqGrid
  16. ASP.NET Server does not process pages asynchronously
  17. How to add ASP.NET 4.0 as Application Pool on IIS 7, Windows 7
  18. Error to use a section registered as allowDefinition=’MachineToApplication’ beyond application level
  19. jqgrid Page 1 of x pager
  20. What are the (dis)advantages of using Cassini instead of IIS?
  21. Escape quote in web.config connection string
  22. Wcf-The maximum message size quota for incoming messages (65536) has been exceeded?
  23. Web Config Transform not working
  24. How can I get a MAC address from an HTTP request?
  25. What happens when I edit web.config?
  26. v11.0\WebApplications\Microsoft.WebApplication.targets was not found when file actually references v10
  27. How do I crop the contents of an Iframe to show a part of a page?
  28. How to disable submit behaviour of asp:ImageButton?
  29. When Does Asp.Net Remove Expired Cache Items?
  30. How can I encrypt a querystring in asp.net?

Leave a Comment