ASP.NET to SP 2010 Single Sign On

Question

Here is my scenario:

• We have a main web application written in ASP.NET that uses forms authentication (uses the default asp.net membership and role provider)

• We have a 2010 sharepoint portal that is configured to use forms authentication (it points to the same AspNetDB that our main web application does)

We would like to link from our main application (the regular ASP.NET one) to the sharepoint app and not have to re-login. Both sites have the same top level domain and machineKey web.config settings. I figured all of this would 'just work' because the forms authentication cookie would sent to the SP site and it would recognize that this is an already authenticated user. This doesn't work and I am not exactly sure why. I noticed the SP site writes the FedAuth cookie, and I wasn't expecting that.

Any idea's/links/hints. Anything would be appreciated.

Thanks, Matt

Answer 1

If the machinekey (defined in Web.Config) matches, the login should automatically be shared across, since this is what encrypts the authentication ticket when your session is being established.

I got this working on a SharePoint Server 2007, but I cant see why it shouldnt work on SP2010.

Let me know how you fare with this, since I seem to remember some issues depending on the domain of the two apps (eg. app.mysite.com and www.mysite.com works, but not myappssite.com and mysite.com)

EDIT: i just found an old P&P article on the subject, where it states you need to manually construct your decrytionKey and insert it in web.config. This might be how i did it as well, its been a couple of years so i cant remember the specifics. Anyhow here is the link : http://msdn.microsoft.com/en-us/library/ff649308.aspx#paght000007_sharingauthenticationtickets

Answer 2

The Forms Auth Cookie will not work in SharePoint 2010 it has a new Fed auth cookie the forms cookie will actually create other problems if generated in SP 2010 and if passed or reused from elsewhere it will probably just ignore it. I belive that you can go the other way from SharePoint 2010 to Forms, MVC etc also your Forms App I believe should be able to pass a Claim to SharePoint Windows Auth will work b/w the two obviously. You will need I think to wrap up your Forms auth and get an SPCLaim for it to Pass to SP2010 alternatively you can probably get authenticated via the SP2010 web services if you pass the right info.

Forms MVC etc can also use claims authentication it is just an issue of creating a SharePoint 2010 claim that SharePoint 2010 can recognise and authenticate.