I would suggest the way Stack Overflow, Microsoft, Facebook, Google Accounts do, and that is even more efficient because every website can be on any different machines.
Assume, you have AuthSite. This is the one site where you have to login, and has membership information.
And you have SiteA, SiteB, and SiteC on different servers.
On login page of SiteA you have to setup a form post with a secret on AuthSite.
If you had previously logged successfully on AuthSite, it will just redirect back to SiteA with successful secret in the form of a hidden Form Post in the browser, that you have to verify in SiteA.
This model is highly extensible and scalable. Because maintanence in the long run is easy.
Code on LoginPage of SiteA, SiteB and SiteC follows.
Login.aspx on SiteA, SiteB, and SiteC:
private void Page_Load(object sender, EventArg e){
// Simply redirect back to AuthSite...
// Change Site parameter accordingly.
Response.Redirect("http://authsite/Login.aspx?Site=SiteA");
}
Login.aspx on AuthSite:
// Define one hidden field named "ReturnSite".
private void Page_Load(object sender, EventArg e){
if(IsPostBack)
return;
string site = Request.QueryString["Site"];
if(Request.User.IsAuthenticated){
string secrete = CreateSomeSecrete(site);
Response.Redirect("http://" + site +
"/AuthConfirm.aspx?Token=" + secrete +
"&User=" + Request.User.Identity.Name);
return;
}
ReturnSite.value = site;
// Do usual login...
}
private void LoginButton_Click(object sender, EventArg e){
string secrete = CreateSomeSecrete(ReturnSite.value);
FormAuthentication.SetAuthCookie(username,true);
// You can retrive username later by calling
// Request.User.Identity.Name.
Response.Redirect("http://" + ReturnSite.value +
"/AuthConfirm.aspx?Token=" + secrete + "&User=" + username);
}
AuthConfirm.aspx on SiteA, SiteB, and SiteC:
private void Page_Load(object sender, EventArg e){
string secrete = Request.QueryString["Token"];
// Verify that secret came only from AuthSite.
if(VerifySecrete(secrete)){
// This sets authentication cookie for Current Site
FormsAuthentication.SetAuthCookie(Request.QueryString["User"], true);
}
}
Now let's see a different scenario.
Same User, First time login
- The first user, John, visiting SiteA (not yet logged in) gets redirected to AuthSite.
- AuthSite checks and finds out that user does not have an authentication cookie, so actual credentials are asked.
- AuthSite sets token on itself and passes secret to AuthConfirm page on SiteA. SiteA verifies the token and sets the authentication cookie and lets user to visit secure pages.
Same User, First time on SiteB
- User John is successfully logged into SiteA using AuthSite, now tries to visit SiteB.
- SiteB finds the user is not logged in so it is directed to AuthSite.
- AuthSite finds that the user already has a cookie for AuthSite website.
- AuthSite redirects user back to SiteB with the authentication secret.
- SiteB verifies the secret and lets John continue to visit secure
pages.
