title: ASP.NET MVC Single Sign-on and Roles
body: <p>I have basic Single Sign-On working across 2 MVC sites (call them SiteA and SiteB) using something along the lines of the following method:</p>
  
  <p><a href="http://forums.asp.net/p/1023838/2614630.aspx" rel="nofollow noreferrer">http://forums.asp.net/p/1023838/2614630.aspx</a></p>
  
  <p>They are on sub-domains of the same domain and share hash\encryption keys etc in web.config. I've modified the cookie so it is accessible to all Sites on the same domain. All of this seems to be working ok.</p>
  
  <p>The sites are on <strong>separate servers</strong> without access to the same SQL database, so only SiteA actually holds the user login details. SiteB has a membership database, but with empty users.</p>
  
  <p>This works fine for my required scenario which is:</p>
  
  <p>1) User logs into SiteA</p>
  
  <p>2) The application loads data from SiteA (by AJAX) and SiteB (by AJAX using JSONP)</p>
  
  <p>I have the following LogOn Action on my AccountController for SiteA, which is where the "magic" happens:</p>
  
  <pre><code>[HttpPost]
  public ActionResult LogOn(LogOnModel model, string returnUrl)
  {
      if (ModelState.IsValid)
      {
          if (MembershipService.ValidateUser(model.UserName, model.Password))
          {
              FormsService.SignIn(model.UserName, model.RememberMe);
  
              //modify the Domain attribute of the cookie to the second level of domain
              // Add roles  
              string[] roles = Roles.GetRolesForUser(model.UserName);
              HttpCookie cookie = FormsAuthentication.GetAuthCookie(User.Identity.Name, false);
              FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);
              // Store roles inside the Forms cookie.  
              FormsAuthenticationTicket newticket = new FormsAuthenticationTicket(ticket.Version, model.UserName, 
                  ticket.IssueDate, ticket.Expiration, ticket.IsPersistent, String.Join("|", roles), ticket.CookiePath);
              cookie.Value = FormsAuthentication.Encrypt(newticket);
              cookie.HttpOnly = false;
              cookie.Domain = ConfigurationManager.AppSettings["Level2DomainName"];
              Response.Cookies.Remove(cookie.Name);
              Response.AppendCookie(cookie);
  
              if (!String.IsNullOrEmpty(returnUrl))
              {
                  return Redirect(returnUrl);
              }
              else
              {
                  return RedirectToAction("Index", "Home");
              }
          }
          else
          {
              ModelState.AddModelError("", "The user name or password provided is incorrect.");
          }
      }
  </code></pre>
  
  <p>This does some stuff which I don't strictly need for the initial scenario, but relates to my question. It inserts the Roles list for the user on login to SiteA into the UserData of the authentication ticket. This is then "restored" on SiteB by the following in global.asax:</p>
  
  <pre><code>protected void Application_AuthenticateRequest(Object sender, EventArgs e)
  {
      if (Context.Request.IsAuthenticated)
      {
          FormsIdentity ident = (FormsIdentity) Context.User.Identity;
          string[] arrRoles = ident.Ticket.UserData.Split(new[] {'|'});
          Context.User = new System.Security.Principal.GenericPrincipal(ident, arrRoles);
      }
  }
  </code></pre>
  
  <p>All of the stuff above works until I add Roles into the mix. Things work fine if I only decorate my Controllers\Actions on SiteB with [Authorize] attributes.  But as soon as I add [Authorize(roles="TestAdmin")] users can no longer access that Controller Action. Obviously I have added the user to the TestAdmin Role.</p>
  
  <p>If I debug the global.asax code on SiteB, it looks ok as I leave the global.asax code, BUT then when I hit a break point in the controller itself the Controller.User and Controller.HttpContext.User is now a System.Web.Security.RolePrincipal without the roles set anymore. </p>
  
  <p>So my question is: Does anybody have any idea how I can restore the roles on SiteB or another way to do this?</p>