How to design asp.net business app and sharepoint to support Single Sign On?

Question

HI In our company we have to rewrite most application and also implement a portal. Our approch is to use Sharepoint Server 2010 and asp.net 4.0 for our business applications. Our main concern is to have ability to work with business applications through share point portal using Single Sign On. We prefer to use form authentication for business software but this also can be reviewed if neccessary. So I am asking you:

1. What is the the most simple solution for doing this?
2. How to develop web aplications that will support SSO with the portal?
3. What additional parts will I need to develop or purchase for sharepoint to make it sign me in my business applications? How will I be able to to manage user's credentials associations programatically?

Please answer me even if you now answer for not al questions. thanks in advance

Answer 1

Yes, you can set the user credentials yourself via the Secure Store, the process is detailed here

http://technet.microsoft.com/en-us/library/ee806866.aspx#set

In terms of authenticating with the credentials stored in the SharePoint Secure Store it depends on what exactly are you trying to achieve. Are you simply logging users in automatically and redirecting them to the business application or are you looking to present the business application data within your SharePoint portal?

Answer 2

In the ideal world you'll be using claims authentiation accross enterprise applications to sign people in where AD holds the one identity (username, password, additional user info) for each employee. SharePoint 2010 supports this model however your other business applications may not be.

I assume you are not operating in the ideal world (I know no one that does yet :) and your SharePoint 2010 portal uses NTLM auth while your business applications implement forms authentiation where employees have individual logins. If this is the case you can use the Single Sign on capabilities within SharePoint which allow you to store multiple credentials per employee that can be used via the API http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.portal.singlesignon.aspx

I have developed this for a client in the past where the process was as follows:

1. User accesses a link leading to an external application (external to SharePoint but not necessarily external to the organisation, both scenarios work here)
2. If the SSO store does not yet have the account details of the current user for the requested application, the user is redirected to a form to fill those out
3. The credentials are then stored in the SharePoint SSO and the user is logged in against the external application

Let me know if this is close to what you need and I can provide further guidance if necessary. Thanks