asp.net mvc 3 - SSO (Single sign on ) in MVC

Question

has anyone implemented signgle sign on in MVC? Can anyone give me any example for single sign on in MVC.

Answer 1

I've implemented a SSO solution between multiple ASP.NET MVC applications hosted on the same parent domain (app1.domain.com, app2.domain.com, ...) by using Forms Authentication and setting the domain property of the cookie in web.config of all applications:

<forms 
   name="ssoauth" 
   loginUrl="/login" 
   protection="All"
   timeout="120"
   requireSSL="true"
   slidingExpiration="false">
   domain="domain.com" 
/>

When you set the domain property of the cookie, this cookie will automatically be sent by the client browser to all applications hosted on this domain and will be able to authenticated the user automatically.

If you want to implement a cross domain SSO using Forms Authentication here's what you could do:

1. The user navigates to foo.com and signs in. The application hosted on foo.com uses standard Forms Authentication, nothing fancy.
2. The user decides to go to bar.com and clicks on a link that you created. This link could contain a token parameter which will contain the encrypted username. This encryption could be done using the machine keys and look something like this: https://bar.com?token=ABC.
3. The application hosted on bar.com receives the request and because it uses the same machine keys as the other application it is capable of decrypting the token and fetching the username. Then it simply signs in the user by emitting an authentication cookie locally and the user is automatically signed in bar.com.