I am currently using Azure ACS as the identity provider for both a SharePoint Server 2013 web application and a custom ASP.Net application (intended to be a Provider-Hosted App):
I can login to both systems and the federated identity is successfully coming through and populating the SAML claims, however I keep getting login prompts when I switch from one to the other...
- I load SharePoint and my ACS Identity Provider asks me to login.
- I login to Windows Live and login using my Hotmail account.
- I load my ASP.Net application, and my ACS Identity Provider asks me to login again.
I want the ASP.Net application to just log-in (as I am already authenticated in SharePoint)
I have tried different setups, but I currently have Azure ACS configured as a Single Relying Party Application with multiple Reply Addresses (configured through the Management API).
Potential issue with fedAuth cookie?
What I find is that SharePoint creates its own "fedAuth" cookie which is a completely different format to ASP.Net. I can modify the web.config to make sure the cookieHandler element in both applications uses the same shared domain (mjh.local) but then my ASP.Net application throws errors because the cookie format is not correct:
ID4230: The SecurityToken was not well formed. Expecting element name 'SecurityContextToken', found 'SP'.
As a result I currently have them both using different cookie names (spFedAuth and aspFedAuth).