I have a need to provide single sign on capabilities within the same enterprise - meaning sometimes I'll need access to the user's name and password. A few examples:
- SSO to OWA (forms based)
- SSO to "legacy" portal - custom form / cookie
- SSO to other BASIC authentication applications
Right now there is custom code / ISAPIs that will translate a cookie into a BASIC authentication header. I am looking at alternatives to that process - potentially more secure / claims based approaches.
One option I can think of would be the following:
- Enable Forms authentication + AD/LDAP membership provider
- Once authenticated programmatically store/update the user's credentials in the secure store
- Leverage the secure store to get current user's credentials needed to sign on to the other systems
Is this a good use of the secure store? Would it be better to add the user name/password to the forms auth cookie/ticket (encrypted)?
Is there anyway to translate a Forms ticket to a Basic Authentication Header?
What are some of the things others have done to accomplish SSO between enterprise applications?