1 webapplication, which consists of 2 host-named sitecollections:

  • abc.domain.com
  • xyz.domain.com

The webapplication is claim-based - with different authentication mechanisms:

  • Anonymous
  • Form based Authentication
  • Windows Authentication


When I log in on abc.domain.com, it creates a FedAuth cookie, by default registered with domain "abc.domain.com". Now, when I try to navigate to xyz.domain.com I have to log in again.


How can I make sure that I don't have to log in again when navigating between those 2 site collections?


I already tried to modify the FedAuth cookie domain to "domain.com". This works but then I have the problem that I can't sign out properly + when the user closes the browser, re-opens it, the user isn't logged in anymore.

FederatedAuthentication.SessionAuthenticationModule.CookieHandler.Domain = "domain.com";
SessionSecurityToken sessionToken = new SessionSecurityToken((IClaimsPrincipal)Thread.CurrentPrincipal);

Any suggestions? Thanks!

1 Answer 1


You could use an STS:

All SharePoint sites that make use of the same STS will effectively have SSO.

A drawback to STS/Trusted Identity Providers is the bad People Picker experience; no resolving of partial entries, every mapped claim can be selected, ... Not a good user experience. Part of it can be solved by implementing a Claim Provider.

  • Thanks Steven! Seems not that easy, but we will have a look at it. We already use a custom claim provider. Jul 18, 2013 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.