title: I am trying to implement SSO in .net core 3.1 by sharing cookies between apps (Login and Web page)
body: <p>I am trying to implement SSO by sharing cookies between two .net core 3.1 apps. I have followed <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-3.1" rel="noreferrer">this link</a>. I am trying to implement it by Sharing Cookies between the applications as mentioned in the link.</p>
  
  <p>My idea is if a user is unauthorized, it should not be able to view the Second Index (view) page. It should redirect itself to the Login page in the first application and successfully login then should be able to see the page. if the user is already logged in then it should directly show the page.This is my idea.</p>
  
  <p>My question is:</p>
  
  <p>How to redirect it to login page? The two web app are different applications. </p>
  
  <p>My code is below. But it doesn't redirect it.
  My first application  which is the <code>Login APP Startup.cs</code> file looks like this </p>
  
  <pre><code>public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
  
          public void ConfigureServices(IServiceCollection services)
          {
  
              services.AddControllersWithViews();
  
              services.AddAuthentication("Identity.Application")
              .AddCookie("Identity.Application", options =&gt;
                {
                  options.Cookie.Name = ".AspNet.SharedCookie";
                  options.Cookie.Path = "/Home/Login";
               });
  
              services.AddDataProtection()
              .PersistKeysToFileSystem(new DirectoryInfo(@"C:\Users\Yourname\AppData\Local\ASP.NET\DataProtection-Keys"))
             .SetApplicationName("SharedCookieApp");
              services.AddDataProtection()
                .ProtectKeysWithDpapi();
  
              services.ConfigureApplicationCookie(options =&gt; {
                  options.Cookie.Name = ".AspNet.SharedCookie";
              });
  
          }
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler("/Home/Error");
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                  app.UseHsts();
              }
              app.UseHttpsRedirection();
              app.UseStaticFiles();
  
              app.UseRouting();
  
              app.UseAuthorization();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllerRoute(
                      name: "default",
                      pattern: "{controller=Home}/{action=Login}/{id?}");
              });
          }
      }
  </code></pre>
  
  <p>HomeController:</p>
  
  <pre><code>public ActionResult Login()
          {
              var userClaims = new List&lt;Claim&gt;()
              {
                  new Claim(ClaimTypes.Name,"Bob"),
              };
  
              var usrIdentity = new ClaimsIdentity(userClaims, "userIdentity");
              var usrPrinci = new ClaimsPrincipal(new[] { usrIdentity });
  
              HttpContext.SignInAsync(usrPrinci);
              return View();
          }
  </code></pre>
  
  <p>Login View:</p>
  
  <pre><code>@{
      ViewBag.Title = "Login";
  }
  
  &lt;h2&gt;Login&lt;/h2&gt;
  @Html.ValidationSummary()
  @Html.AntiForgeryToken()
  &lt;div class="form-group"&gt;
      @Html.Label("Username")
      @Html.Editor("UserName")
  &lt;/div&gt;
  &lt;div class="form-group"&gt;
      @Html.LabelForModel("Password")
      @Html.Password("Password")
  &lt;/div&gt;
  &lt;input class="btn btn-primary" type="submit" value="Login" /&gt;
  </code></pre>
  
  <p>The second application:</p>
  
  <p>StartUp.cs</p>
  
  <pre><code>public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddControllersWithViews();
  
             services.AddDataProtection().PersistKeysToFileSystem(new DirectoryInfo(@"C:\Users\yourname\AppData\Local\ASP.NET\DataProtection-Keys"))
            .SetApplicationName("SharedCookieApp");
  
  
              services.AddDataProtection()
                  .ProtectKeysWithDpapi();
  
  
             services.AddAuthentication("Identity.Application")
                  .AddCookie("Identity.Application", options =&gt;
                  {
                      options.Cookie.Name = ".AspNet.SharedCookie";
                      options.LoginPath = "/Home/Login";
                      options.SlidingExpiration = true;
  
                 });
          }
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler("/Home/Error");
                      app.UseHsts();
              }
              app.UseHttpsRedirection();
              app.UseStaticFiles();
  
              app.UseRouting();
              app.UseAuthentication();
  
  
              app.UseAuthorization();
  
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapControllerRoute(
                      name: "default",
                      pattern: "{controller=Home}/{action=Index}/{id?}");
              });
          }
      } 
  </code></pre>
  
  <p>Home:</p>
  
  <pre><code>[Authorize(AuthenticationSchemes = "Identity.Application")]
       public class HomeController : Controller
      {
         public IActionResult Index()
          {
              return View();
          }
      }
  </code></pre>
  
  <p>View is:</p>
  
  <pre><code>@{
      ViewData["Title"] = "Home Page";
  }
  &lt;div class="text-center"&gt;
      &lt;h1 class="display-4"&gt;Welcome&lt;/h1&gt;
  
  &lt;/div&gt;
  </code></pre>
  
  <p>In my second application i am setting the <code>Options.LoginPath</code> in <code>Startup.cs</code> to the previous application login View. But it does not redirect it.</p>
  
  <p>The error that comes is </p>
  
  <blockquote>
    <p>No webpage was found for the web address: <a href="https://localhost" rel="noreferrer">https://localhost</a>:******/Home/Login?ReturnUrl=%2F</p>
  </blockquote>
  
  <p>The port value above does not change. The port value in the above URL is that of the second app. Ideally, It should change to first app port value.</p>
  
  <p>Can anyone suggest what is missing from the code?</p>