Member Avatar for blackcorner

I have three ASP.Net applications and I want them to share their user status (Anonymous, LoggedIn). For this I use a custom Membership provider which lets me manage my users database effectively. But...
How can I authenticate a user in one of this applications AND let the other two applications know who is authenticated ?
(like Google does with GMail, Google Reader, Google Calendar...)

PS: Remember I use Membership Provider and Login Controls as well.

  • 3 Contributors
  • 3 Replies
  • 133 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by blackcorner

Dani AI

Generated

This thread is about single sign‑on for three ASP.NET apps that already share a custom Membership database. Two practical directions already mentioned here — sharing auth cookies when apps are on the same domain, or issuing a temporary token-on-redirect for cross‑app navigation — are correct. The notes below expand those approaches with concrete configuration, hardening and debugging tips that are often missed.

For apps on the same domain/subdomain the simplest and most robust approach is to share the Forms authentication cookie and the same machineKey and Membership/Role configuration. All apps must use identical machineKey entries and the same <forms> cookie name and domain. Example (placeholders must be replaced with securely generated keys):

<machineKey validationKey="GENERATE_LONG_KEY" decryptionKey="GENERATE_LONG_KEY" validation="HMACSHA256" decryption="AES" />

<system.web>
  <authentication mode="Forms">
    <forms name=".MYAUTH" loginUrl="/Account/Login" domain=".example.com" path="/" protection="All" timeout="30" />
  </authentication>
</system.web>

For apps on different domains, use a central authentication service (an STS) that issues signed tokens (JWT/SAML/OAuth2/OIDC). Each app trusts that STS, validates the token and then issues a local session cookie. The redirect-with-a-one-time-token idea mentioned by can be used here, but the token must be short‑lived, signed, one‑time use and transported only over HTTPS.

Security and operational notes: always use HTTPS; set cookies as HttpOnly and Secure; use SameSite settings appropriate for cross‑site flows; validate token issuer/audience/expiry; store tokens as one‑time entries or include nonce to prevent replay; rotate keys and provide a token revocation mechanism for logout/forced logout.

Common debugging checklist: confirm cookie domain/path and name in browser dev tools; check for machineKey mismatch errors in logs; ensure identical Membership/Role provider settings and connection strings; verify load‑balancer/session affinity and that cookies are not being stripped. As and suggested, either route is workable — choose same‑domain cookie sharing for simplicity or an STS/OIDC solution for cross‑domain and enterprise scenarios.

Recommended Answers

All 3 Replies

Member Avatar for sedgey

I think the generic description for this is single sign on, there are several ways to achieve it, some are more secure than others, essentially google is using cookies combined with a check that the user is allowed access to a particular application.

By default ASP.NET authentication uses an auth cookie to handle authentication to a site, but to achieve single sign on you will need to automatically create a new authentication cookie for each application a user accesses.

One way to do this could be to have the links to your other applications as link buttons, then add logic to the link button click like:

1. Check the user is authenticated in the current application.
2. Generate a random GUID for this user and save it to an auth table in the DB
3. Send the user to the next app with the GUID on the query string
4. check the guid against the database (the same query will delete this GUID and any old GUID's left in the table e.g. when someone cancels the navigation).
5. authenticate the user for the new application

the same authentication check in the new application could also check that the user has access to the new application.

There are many ways to achieve the same thing, but this method is pretty secure.

Member Avatar for blackcorner

I have found some really great articles about this subject at CodeProject. Check this out:
http://www.codeproject.com/KB/aspnet/SingleSignon.aspx

Thanks to all of you for your answers, they help to clarify what my problem was.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.