"Single sign-on" using existing ASP.NET user store

Question

(Using inverted commas because I don't think this is strictly a single sign-on use case. Although it's the same concept.)

I have an existing ASP.NET Web Forms site (SiteA) using Membership...

Web.config:

<machineKey validationKey="etc"
    decryptionKey="etc"
    validation="SHA1"
    decryption="AES" />

<authentication mode="Forms">
    <forms name="goodcookie"
        loginUrl="~/login"
        timeout="2880"
        defaultUrl="~/" />
</authentication>

<membership>
    <providers>
        <clear />
        <add name="AspNetSqlMembershipProvider"
            type="System.Web.Security.SqlMembershipProvider"
            connectionStringName="etc"
            applicationName="etc" />
    </providers>
</membership>

<roleManager enabled="true">
    <providers>
        <clear />
        <add connectionStringName="etc"
            applicationName="etc"
            name="AspNetSqlRoleProvider"
            type="System.Web.Security.SqlRoleProvider" />
    </providers>
</roleManager>

Login button's codebehind:

if (Membership.ValidateUser(txtUsername.Value, txtPassword.Value))
{
    FormsAuthentication.SetAuthCookie(txtUsername.Value, true);
    Response.RedirectToRoute("home");
}

Master page's codebehind for each page load:

if (!HttpContext.Current.User.Identity.IsAuthenticated)
{
    Response.Clear();
    Response.Redirect("/login", true);
}

There's a requirement to create a new site (SiteB) on a separate domain, however both SiteA and SiteB will use the same database.

Some users will only have access to SiteA, some only to SiteB, and some to both SiteA and SiteB. This will be determined by their role(s).

I've created SiteB with identical values in Web.config (same cookie name, same machine key, etc). Even the same application name just to test. Of course I'm able to log in to both sites with the same user credentials, but.. if I'm logged in to SiteA, and I load SiteB, it will behave like I'm not authenticated (ie. redirect me to the login page).

What could I be missing?

(Will edit if I think of any more relevant details)

score 0 · Answer 1 · answered Feb 20 '19 at 19:05

Different domains cannot read coookies of each other and thus if you logged in to SiteA the authentication cookie isn't sent when you request SiteB. But different subdomains can share cookies so moving sites to single domain should be a solution. Also read this question and answers for more information.

"Single sign-on" using existing ASP.NET user store

1 Answers1