I'm working with a SharePoint farm that has one content web application and one My Sites web application. The apps are configured for clamis-based authentication using a combination of OpenSSO and ADFS.
Authentication works correctly, and everything goes smoothly when switching from the content web app to the user profile page. However, there's one minor glitch that irritates: when a user clicks on the "my profile" link, they get redirected to the SSO application and back, and this results in a page between the content app and the profile page in the browser history. Now, clicking 'back' brings you to an ADFS page saying it has already expired.
The root cause here seems to be that the content app and my sites are in different subdomains. The authentication cookie is specific to the subdomain, so the My Sites app doesn't know that the content web app has already authenticated the user.
I noticed that there is a web.config setting for setting the cookie domain under
microsoft.identityModel/service/federatedAuthentication/cookieHandler, but according to what Fiddler is showing me, it doesn't seem to have any effect. Is there anything I can do?
Well, getting the configuration to have effect turned out to be the easy part. All I needed to do was configure all the frontends. Turns out, I had missed some. Stupid of me, I know.
Now the problem is getting the authentication ticket to actually work. Since it's an encrypted cookie, I sort of assumed that it would be enough to make all the web apps have the same
<machineKey /> element configuration, but that isn't enough.