0

I am currently using Azure ACS as the identity provider for both a SharePoint Server 2013 web application and a custom ASP.Net application (intended to be a Provider-Hosted App):

I can login to both systems and the federated identity is successfully coming through and populating the SAML claims, however I keep getting login prompts when I switch from one to the other...

Example Scenario

  • I load SharePoint and my ACS Identity Provider asks me to login.
  • I login to Windows Live and login using my Hotmail account.
  • I load my ASP.Net application, and my ACS Identity Provider asks me to login again.

I want the ASP.Net application to just log-in (as I am already authenticated in SharePoint)

I have tried different setups, but I currently have Azure ACS configured as a Single Relying Party Application with multiple Reply Addresses (configured through the Management API).

Potential issue with fedAuth cookie?

What I find is that SharePoint creates its own "fedAuth" cookie which is a completely different format to ASP.Net. I can modify the web.config to make sure the cookieHandler element in both applications uses the same shared domain (mjh.local) but then my ASP.Net application throws errors because the cookie format is not correct:

ID4230: The SecurityToken was not well formed. Expecting element name 'SecurityContextToken', found 'SP'.

As a result I currently have them both using different cookie names (spFedAuth and aspFedAuth).

Any ideas?

0

Ok, so the solution I ended up going with was as follows:

  • Custom login form in SharePoint which stores the Identity Provider that the user logged in with in a secured cross-domain cookie
  • Custom login form in ASP.Net application which looks for that cookie and auto-redirects you to the sign-in page for the specified identity provider

This seems to work well, and I like that other than the name of the identity provider (such as "Google") no other information is being passed around.

Of course this only works if the SharePoint site and ASP.Net application are on the same domain (e.g. .mjh.local) otherwise you can't get the cookie to work in both applications.

Note - As a result they do not need to be the same relying party application either! They just need to support the same Identity Provider in ACS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.