Friday, June 30, 2006

Single Signon in ASP.Net Application

I was trying to find out is it possible to implement SingleSignon in asp.net1.0(Framework1.1) part from using Forms Authentication from ScottGuthrie(http://weblogs.asp.net/scottgu) and Stefan Schackow.
I would like to thank them for their answers.



-Are there any other ways to implement Singlesignon feature using
asp.net?
There are third party products that provide single sign on support for
ASP.NET. Also, Windows Server 2003 R2 includes a feature called Active
Directory Federation Services (ADFS). The driving factor for ADFS was
support for authentication against multiple domains, and the ability to
trust authenticated users from other organizations (e.g. if you log in
against your corporation's website, then you could access a FedEx site
without having to login again). However, ADFS also includes the ability
to log users in using something very similar to forms authentication,
and the ability to share that authentication token across multiple web
sites. There is an overview at:


http://www.microsoft.com/WindowsServer2003/R2/Identity_Management/ADFSwh
itepaper.mspx

And a requirements FAQ at:


http://technet2.microsoft.com/WindowsServer/en/Library/1c2f6235-833a-421
e-8529-3e9cd97da6771033.mspx?mfr=true


Other than that, a lot of folks roll their own SSO solution building on
top of forms authentication. If you search the web there are lots of
articles out there with different approaches. Many of them rely on the
ability to customize the forms authentication cookie so it can be shared
across domains. Something that isn't necessarily clear in forms
authentication in ASP.NET 2.0 is that the domain property of the cookie
can be set. If all of your applications live under the same DNS
namepsace (e.g. foo.contoso.com, bar.contoso.com, baz.contoso.com), then
you can login with one application and issue a forms authentication
cookie that will automatically flow to all of the other sites.

If you go with this approach you will need to ensure that all of the
applications and servers that use the forms authentication cookie have
the same encryption material for protecting the forms authentication
ticket. There is info on this at:


http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/
html/PAGHT000007.asp

0 Comments:

Post a Comment

<< Home