5

We have SharePoint 2013 hooked up to the userstore of a third party web application. The users from that web application are now also known in SharePoint and able to log in using the same credentials.

Now to support a single sign-on type of scenario, I'd like to be able to pre-authenticate users who are already logged in in the third party app. So a user logs in to the third party app and then also gets a cookie with a valid security token for SharePoint.

What would be the best way to implement this scenario? I know about the security token service and the possibility to get a security token (authentication.asmx) which you can then use for webservice calls. Is it possible to call that same webservice from javascript for instance and then place the cookie on the client pc? Or can I somehow redirect the user to a certain URL allowing some sort of pre authentication to take place?

  • Which version of Sharepoint ? – Nikhil J Apr 9 '14 at 13:30
  • Sorry, its 2013. – Jasper Apr 9 '14 at 22:13
  • Added it to your tags, stops the questions. – Lankymart Apr 16 '14 at 8:33
0
+100

I dont think you can use authentication.asmx in that fashion by itself. I think you would need to create a custom authentication provider that could look for and consume the cookie.

Another approach is similar to what @Nikhil is suggesting but instead of using ADFS you use a reverse proxy. TMG used to be a goto here, but MS has discontinued that. Other options are F5, Citrix, and A10. There are some open source options such as Squid can also provide this function (I have not tested Squid in this manner). Basicly this 3rd device is what the user authenticates too and it in turn authenticates to the applications on the users behalf. It can store multiple logins in it's own cookies and make those connection.

  • Sometimes the most simple answers are the best... creating a custom authentication provider allows us to check for a custom cookie of the other app and using that to automatically log in the user. Straightforward, but enough for our goal I think. Thanks! – Jasper Apr 18 '14 at 13:00
2

If you are looking for SSO like scenario ,i think you can implement SAML . Pass the SAML token to Sharepoint(Relying party) , when users login to the third party application(Identity Provider) or click on some link on third party appliction to enter your SharePoint site.

  • Ok, but is it necessary to do so? Can't we achieve the same with an authentication provider? I mean: it is possible to call authentication.asmx to get a valid security token, so we only need to get that on the correct place on the users PC, right? – Jasper Apr 10 '14 at 9:29
  • When you setup SAML authentication , further you have to create a authentication provider as well. I am not sure if you can call authentication.asmx to get valid token . – Nikhil J Apr 10 '14 at 13:33
  • Is the 3rd party a sharepoint application ? Sharepoint needs to create a trust with the 3rd party application . I dont think calling authentication.asmx would solve the purpose. – Nikhil J Apr 11 '14 at 14:09
  • No, it's not. And why wouldn't that work? When you call authentication.asmx for webservices, you are returned a token which is then used to authenticate webservice calls by inserting the cookie in a cookiecontainer which is passed along with the call. If I was to place that cookie on the client computer instead, wouldn't that have the same result? Nevertheless we are looking at the STS implementation as well. – Jasper Apr 14 '14 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.