SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an site and a SharePoint 2010 site. I need to redirect users from my SharePoint site to the site without asking them for the password again?

share|improve this question
Are these Internet, Intranet or Extranet sites? – Dave Wise Jan 11 '12 at 14:42
Internal? External? NTLM auth? Forms auth? – Greg Hurlman Jan 11 '12 at 14:42
To provide a helpful answer you need to explain your current authentication provider and the authentication used for your ASP.NET site. – Russell Jan 11 '12 at 22:40
Sharepoint is doing windows authentication while app is doing forms – RHM Jan 12 '12 at 16:11

Configure your ASP.NET web application to use Windows Integrated authentication, just like SharePoint. Furthermore, configure group policies so that the URL where your ASP.NET application is hosted is considered part of the Local Intranet. This will make IE pass the user's credentials to IIS by using Kerberos.

Alternatively, you can configure the ASP.NET application to use Claims, by setting up an STS (ADFS v2). Then configure the STS to use Windows Authentication.

share|improve this answer

You could use SharePoint's SecureStore to map credentials and pass them to the .NET site.

Another approach is configuring CLAIMs for both SharePoint and your .NET site and relay on the same IdentityProvider (such as ADFS in a Windows environment)

share|improve this answer

trick way

  • use FQDN to access sp and .net site. e.g.,
  • write code run in sharepoint to write FBA cookie for current user, domain:

or you can

  • config app to use NTLM
  • or
  • config sharepoint to use CBA, and app use CBA, they use the same STS.
share|improve this answer
+1, I do recommend the classic top level domain name trick. Never had to opportunity to try a common Claim Based Authentication on both SP & custom solution. As explained in my reply, external solutions are also often dismissed while sometime being already deployed within companies. – Francois Verbeeck Nov 25 '12 at 19:06

I would rely on the same authentication mechanism (eg : ntlm if you're on an intranet) and work with subdomain - as suggested above by Eric - while targeting the cookie to the top level domain name.

Alternatively, you can delegate this requirement to an external tool / system like Microsoft ISA / UAG, SiteMinder, F5 APM, EmpowerID, Oracle Identity Management, ... the biggest advantage is of course compliance with different systems / technologies and the fact that a similar solution might already be in place in your (or your target) environment, waiting for a dedicate configuration to solve this common need.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.