SSO between 2 host-named sitecollections with different subdomains

Question

Setup

1 webapplication, which consists of 2 host-named sitecollections:

• abc.domain.com
• xyz.domain.com

The webapplication is claim-based - with different authentication mechanisms:

• Anonymous
• Form based Authentication
• Windows Authentication

Problem

When I log in on abc.domain.com, it creates a FedAuth cookie, by default registered with domain "abc.domain.com". Now, when I try to navigate to xyz.domain.com I have to log in again.

Question

How can I make sure that I don't have to log in again when navigating between those 2 site collections?

Attemps

I already tried to modify the FedAuth cookie domain to "domain.com". This works but then I have the problem that I can't sign out properly + when the user closes the browser, re-opens it, the user isn't logged in anymore.

FederatedAuthentication.SessionAuthenticationModule.CookieHandler.Domain = "domain.com";
SessionSecurityToken sessionToken = new SessionSecurityToken((IClaimsPrincipal)Thread.CurrentPrincipal);
FederatedAuthentication.SessionAuthenticationModule.WriteSessionTokenToCookie(sessionToken);

Any suggestions? Thanks!

Answer 1

You could use an STS:

• Windows > ADFS
• Forms > custom one (eg http://identityserver.codeplex.com/ or create one)

All SharePoint sites that make use of the same STS will effectively have SSO.

A drawback to STS/Trusted Identity Providers is the bad People Picker experience; no resolving of partial entries, every mapped claim can be selected, ... Not a good user experience. Part of it can be solved by implementing a Claim Provider.