<p>Lets say that you have websites www.xyz.com and www.abc.com.</p>

<p>Lets say that a user goes to www.abc.com and they get authenticated through the normal ASP .NET membership provider. </p>

<p>Then, from that site, they get sent to (redirection, linked, whatever works) site www.xyz.com, and the intent of site www.abc.com was to pass that user to the other site as the status of isAuthenticated, so that the site www.xyz.com does not ask for the credentials of said user again.</p>

<p>What would be needed for this to work? I have some constraints on this though, the user databases are completely separate, it is not internal to an organization, in all regards, it is like passing from stackoverflow.com to google as authenticated, it is that separate in nature. A link to a relevant article will suffice.</p>

[{'answer_id': 72149, 'author': 'Marc Gear', 'author_id': 6563, 'author_profile': 'https://Stackoverflow.com/users/6563', 'pm_score': 0, 'selected': False, 'text': '<p>Not sure what you\'d use for .NET but ordinarily I\'d use <a href="http://www.danga.com/memcached/" rel="nofollow noreferrer">memcached</a> in a LAMP stack.</p>\n'}, {'answer_id': 72278, 'author': 'Matej', 'author_id': 11457, 'author_profile': 'https://Stackoverflow.com/users/11457', 'pm_score': 0, 'selected': False, 'text': '<p>The resolution depends on the type of application and environment in which it is running. E.g. on intranet with NT Domain you can use NTLM to pass windows credentials directly to servers in intranet perimeter without any need to duplicate sessions.</p>\n\n<p>The approach how to do this is generally named <em>single sign-on</em> (see <a href="http://en.wikipedia.org/wiki/Single_sign-on" rel="nofollow noreferrer">Wikipedia</a>). </p>\n'}, {'answer_id': 72301, 'author': 'public static', 'author_id': 1368, 'author_profile': 'https://Stackoverflow.com/users/1368', 'pm_score': 1, 'selected': False, 'text': '<p>If you store user sessions in the database, you could simply check the existance of the Guid in the session table, if it exists, then the user already authenticated on the other domain.  For this to work, you would have to included the session guid in the URL when you redirect the user over to the other website.</p>\n'}, {'answer_id': 72517, 'author': 'Adam Pope', 'author_id': 12226, 'author_profile': 'https://Stackoverflow.com/users/12226', 'pm_score': 2, 'selected': False, 'text': '<p>If you are using the built in membership system you can do cross sub-domain authentication with forms auth by using some like this in each web.config.</p>\n\n<pre><code>&lt;authentication mode="Forms"&gt;\n    &lt;forms name=".ASPXAUTH" loginUrl="~/Login.aspx" path="/" \n                  protection="All" \n                  domain="datasharp.co.uk" \n                  enableCrossAppRedirects="true" /&gt;\n\n&lt;/authentication&gt;\n</code></pre>\n\n<p>Make sure that name, path, protection and domain are the same in all web.configs.  If the sites are on different machines you will also need to ensure that the machineKey and validation and encryption keys are the same.</p>\n'}, {'answer_id': 72676, 'author': 'Markc', 'author_id': 8609, 'author_profile': 'https://Stackoverflow.com/users/8609', 'pm_score': 0, 'selected': False, 'text': '<p>There are multiple approaches to this problem, which is described as "Cross-domain Single Sign On". The wikipedia article pointed to by Matej is particularly helpful if you\'re looking for an open source solution - however - in a windows environment I belive you\'re best off with one of 2 approaches:</p>\n\n<ol>\n<li>Buy a commercial SSO product (like SiteMinder or PingIdentity)</li>\n<li>Use MicroSoft\'s cross-domain SSO solution, called <a href="http://technet.microsoft.com/en-us/library/cc786469.aspx" rel="nofollow noreferrer">ADFS</a> - Active Direcctory Federation Services.  (federation is the term for coordinating the behavior of multiple domains)</li>\n</ol>\n\n<p>I have used SiteMinder and it works well, but it\'s expensive. If you\'re in an all MicroSoft environment I think ADFS is your best bet. Start with this <a href="http://www.microsoft.com/WindowsServer2003/R2/Identity_Management/ADFSwhitepaper.mspx" rel="nofollow noreferrer">ADFS whitepaper</a>.</p>\n'}, {'answer_id': 72887, 'author': 'Toby Mills', 'author_id': 12377, 'author_profile': 'https://Stackoverflow.com/users/12377', 'pm_score': -1, 'selected': False, 'text': '<p>Alternatively if you want to roll your own and the sites in question are not on the same servers or don\'t have access to a shared database (in which case see the above responses) then you could place a <a href="http://en.wikipedia.org/wiki/Web_beacon" rel="nofollow noreferrer">web beacon</a> on each of the sites which would refer back to the other site. </p>\n\n<p>Place a single pixel image (web beacon) on site A which would call site B passing through the users ID (encrypted &amp; time stamped). This would then create a new user session on site B for the user which would be set as logged in. Then when the user visited site B they would already be logged in.</p>\n\n<p>To minimise calls you could only place the web beacon on the home page and or log in confirmation pages. I\'ve used this successfully in the past to pass information between partner sites. </p>\n'}, {'answer_id': 73077, 'author': 'craigmoliver', 'author_id': 12252, 'author_profile': 'https://Stackoverflow.com/users/12252', 'pm_score': 4, 'selected': True, 'text': '<p>Try using FormAuthentication by setting the web.config authentication section like so:</p>\n\n<pre><code>&lt;authentication mode="Forms"&gt;\n  &lt;forms name=".ASPXAUTH" requireSSL="true" \n      protection="All" \n      enableCrossAppRedirects="true" /&gt;\n&lt;/authentication&gt;\n</code></pre>\n\n<p>Generate a machine key. Example: <a href="https://blogs.msdn.microsoft.com/amb/2012/07/31/easiest-way-to-generate-machinekey/" rel="nofollow noreferrer">Easiest way to generate MachineKey – Tips and tricks: ASP.NET, IIS ...</a></p>\n\n<p>When posting to the other application the authentication ticket is passed as a hidden field. While reading the post from the first app, the second app will read the encrypted ticket and authenticate the user.  Here\'s an example of the page that passes that posts the field:</p>\n\n<p>.aspx:</p>\n\n<pre><code>&lt;form id="form1" runat="server"&gt;\n  &lt;div&gt;\n    &lt;p&gt;&lt;asp:Button ID="btnTransfer" runat="server" Text="Go" PostBackUrl="http://otherapp/" /&gt;&lt;/p&gt;\n    &lt;input id="hdnStreetCred" runat="server" type="hidden" /&gt;\n  &lt;/div&gt;\n&lt;/form&gt;\n</code></pre>\n\n<p>code-behind:</p>\n\n<pre><code>protected void Page_Load(object sender, EventArgs e)\n{\n    FormsIdentity cIdentity = Page.User.Identity as FormsIdentity;\n    if (cIdentity != null)\n    {\n        this.hdnStreetCred.ID = FormsAuthentication.FormsCookieName;\n        this.hdnStreetCred.Value = FormsAuthentication.Encrypt(((FormsIdentity)User.Identity).Ticket);\n    }\n}\n</code></pre>\n\n<p>Also see the cross app form authentication section in Chapter 5 of this <a href="http://www.wrox.com/WileyCDA/WroxTitle/Professional-ASP-NET-2-0-Security-Membership-and-Role-Management.productCd-0764596985.html" rel="nofollow noreferrer">book</a> from Wrox. It recommends answers like the ones above in addition to providing a homebrew SSO solution. </p>\n'}, {'answer_id': 73116, 'author': 'Community', 'author_id': -1, 'author_profile': 'https://Stackoverflow.com/users/-1', 'pm_score': 0, 'selected': False, 'text': '<p>I would user something like CAS:</p>\n\n<p>[1]: <a href="http://www.ja-sig.org/products/cas/" rel="nofollow noreferrer">http://www.ja-sig.org/products/cas/</a> CAS</p>\n\n<p>This is a solved problem and wouldn\'t recommend rolling your own. </p>\n'}]
['https://Stackoverflow.com/questions/72125', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/7952/']