title: What is the best way to implement SSO for ASP.NET Web Apps with Active Directory?
body: <p>My organisation has several web facing ASP.NET Web Forms Apps. They currently use Windows Authentication with impersonation enabled. The web apps are hosted internally but are exposed publicly via different domains e.g. www.abc.com &amp; www.xyz.org.</p>
  
  <p>A new requirement, is that a single log on page will be provided for all users of these apps to log in via.</p>
  
  <p>Some of the solutions proposed are:</p>
  
  <ul>
  <li>Implement an OpenId Provider backed by Active Directory (DotNetOpenAuth), modify existing apps to become relying parties of this OP.</li>
  <li>Implement SSO through MS Forefront Threat Management Gateway.</li>
  </ul>
  
  <p>I don't have experience with either of these. Are the proposed solutions feasible? What are the pros and cons of each? Are there other solutions that might be more appropriate?</p>