Single Sign On with Forms Authentication

问题:

I am trying to set up Single sign on for 2 websites that reside on the same domain

e.g.

http://mydomain (top level site that contains a forms-auth login page)

http://mydomain/admin (seperately developed website residing in a Virtual Application within the parent website)

Have read a few articles on Single Sign on e.g.

http://www.codeproject.com/KB/aspnet/SingleSignon.aspx

http://msdn.microsoft.com/en-us/library/dd577079.aspx

And they seem to suggest it is just a case of having the same machinekey section in each web.config so that the cookie encryption and decryption is the same for each application

I have set this up and I never get prompted for credentials in the sub-website (the virtual application)

I always get prompted in the parent site.

In addition to having the same machinekey I've also tried adding the same <authentication> and <authorisation> elements

Any idea what I could be missing?

回答1:

Your forms section of web.config needs to be the same as well.

Quote from - Forms Authentication Across Applications

To configure forms authentication across applications, you set attributes of the forms and machineKey sections of the Web.config file to the same values for all applications that are participating in shared forms authentication.

The following example shows the Authentication section of a Web.config file. Unless otherwise noted, the name, protection, path, validationKey, validation, decryptionKey, and decryption attributes must be identical across all applications. Similarly, the encryption and validation key values and the encryption scheme and validation scheme used for authentication tickets (cookie data) must be the same. If the settings do not match, authentication tickets cannot be shared.

回答2:

I had used <clear/> on the httpModules section, as there were items in the parent that did not exist in the bin dir for the child (/admin)

In doing so (using <clear/> that is ) I had inadvertently cleared the FormsAuthentication module specified in the web.config in C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG

so i needed to re-add those explicitly to the child (/admin) config

回答3:

Try configuring the httpCookies section in the web.config of both applications to use the same domain. That way when you log-in to one app the FormsAuthentication cookie you get will be visible to the other application.

回答4:

You need to have the same authentication elements in the web.config. In the contained forms element, make sure you give each application the same value for the name attribute. For the loginUrl attribute, I use a relative path and use the same logon page for all of the applications (e.g. loginUrl="/MainApp/login.aspx").

Also, are you creating the authentication ticket manually?

回答5:

There is a breaking change in ASP.NET 4.5's token generation

If you're mixing ASP.NET 4.5 apps with apps targeting earlier versions, you will need to ensure compatible tokens are used everywhere. Add this attribute to the <machineKey> on any site targeting .NET 4.5 or higher:

<system.web>
  <machineKey compatibilityMode="Framework20SP2" /> 
</system.web>

See this answer for more details. Special thanks to this comment which pointed me in the right direction.