Here is my scenario:

  • We have a main web application written in ASP.NET that uses forms authentication (uses the default asp.net membership and role provider)

  • We have a 2010 sharepoint portal that is configured to use forms authentication (it points to the same AspNetDB that our main web application does)

We would like to link from our main application (the regular ASP.NET one) to the sharepoint app and not have to re-login. Both sites have the same top level domain and machineKey web.config settings. I figured all of this would 'just work' because the forms authentication cookie would sent to the SP site and it would recognize that this is an already authenticated user. This doesn't work and I am not exactly sure why. I noticed the SP site writes the FedAuth cookie, and I wasn't expecting that.

Any idea's/links/hints. Anything would be appreciated.

Thanks, Matt

  • I wonder if anyone solved this yet. I have just spent quite a bit of time setting up an environment thinking that a sharepoint site and an asp.net site would be able to share a forms authentication ticket using a custom provider to access my database. I'm hitting exactly the same problem as you guys in that sharepoint doesn't like my auth cookie and I also noticed the FedAuth cookie which surprised me. Did you ever get it working and if so, what was the approach? Any input greatly appreciated. Many thanks Greg
    – user14406
    Commented Jan 25, 2013 at 3:45

2 Answers 2


If the machinekey (defined in Web.Config) matches, the login should automatically be shared across, since this is what encrypts the authentication ticket when your session is being established.

I got this working on a SharePoint Server 2007, but I cant see why it shouldnt work on SP2010.

Let me know how you fare with this, since I seem to remember some issues depending on the domain of the two apps (eg. app.mysite.com and www.mysite.com works, but not myappssite.com and mysite.com)

EDIT: i just found an old P&P article on the subject, where it states you need to manually construct your decrytionKey and insert it in web.config. This might be how i did it as well, its been a couple of years so i cant remember the specifics. Anyhow here is the link : http://msdn.microsoft.com/en-us/library/ff649308.aspx#paght000007_sharingauthenticationtickets


The Forms Auth Cookie will not work in SharePoint 2010 it has a new Fed auth cookie the forms cookie will actually create other problems if generated in SP 2010 and if passed or reused from elsewhere it will probably just ignore it. I belive that you can go the other way from SharePoint 2010 to Forms, MVC etc also your Forms App I believe should be able to pass a Claim to SharePoint Windows Auth will work b/w the two obviously. You will need I think to wrap up your Forms auth and get an SPCLaim for it to Pass to SP2010 alternatively you can probably get authenticated via the SP2010 web services if you pass the right info.

Forms MVC etc can also use claims authentication it is just an issue of creating a SharePoint 2010 claim that SharePoint 2010 can recognise and authenticate.

  • I'm working now to do exactly this (wrap Forms auth into an SPClaim) but I can't figure how to make it work. Do you have an implementation to share so I can understand what I'm doing wrong? Thanks. Commented Jun 8, 2012 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.