Single Sign On with Forms Authentication

Question

I am trying to set up Single sign on for 2 websites that reside on the same domain

e.g.

http://mydomain (top level site that contains a forms-auth login page

Answer 1

You need to have the same authentication elements in the web.config. In the contained forms element, make sure you give each application the same value for the name attribute. For the loginUrl attribute, I use a relative path and use the same logon page for all of the applications (e.g. loginUrl="/MainApp/login.aspx").

Also, are you creating the authentication ticket manually?

Answer 2

There is a breaking change in ASP.NET 4.5's token generation

If you're mixing ASP.NET 4.5 apps with apps targeting earlier versions, you will need to ensure compatible tokens are used everywhere. Add this attribute to the <machineKey> on any site targeting .NET 4.5 or higher:

<system.web>
  <machineKey compatibilityMode="Framework20SP2" /> 
</system.web>

See this answer for more details. Special thanks to this comment which pointed me in the right direction.

Answer 3

Your forms section of web.config needs to be the same as well.

Quote from - Forms Authentication Across Applications

To configure forms authentication across applications, you set attributes of the forms and machineKey sections of the Web.config file to the same values for all applications that are participating in shared forms authentication.

The following example shows the Authentication section of a Web.config file. Unless otherwise noted, the name, protection, path, validationKey, validation, decryptionKey, and decryption attributes must be identical across all applications. Similarly, the encryption and validation key values and the encryption scheme and validation scheme used for authentication tickets (cookie data) must be the same. If the settings do not match, authentication tickets cannot be shared.

Answer 4

Try configuring the httpCookies section in the web.config of both applications to use the same domain. That way when you log-in to one app the FormsAuthentication cookie you get will be visible to the other application.

Answer 5

I had used <clear/> on the httpModules section, as there were items in the parent that did not exist in the bin dir for the child (/admin)

In doing so (using <clear/> that is ) I had inadvertently cleared the FormsAuthentication module specified in the web.config in C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG

so i needed to re-add those explicitly to the child (/admin) config