Question

I implemented single sign on by reading this article:

http://www.codeproject.com/KB/web-security/aspnetsinglesignon.aspx

However, I have a question from the extensibility point of view. Will the method shown above work if I host 1st application on 1 machine and 2nd application on different machine. I don’t have 2 different servers at the moment otherwise I would have verified it myself. Anybody has any experience?

Thanks.

Answer 1

Yes, it will work as long as your encryption and validation keys defined in the machine.config on both servers are exactly the same. If you forget this it won’t work since a cookie encrypted on one server won’t be decrypted on the other server(s).

The article suggests putting these keys on Web.config. That’s a valid approach, but if you need SSO on multiple websites, it’s probably best to define it in machine.config provided you have control over this and all your apps in the same server are meant to share this functionality.