OpenId Authentication through different web sites in MVC

Question

I have to develop a web site that implements a custom authentication. No problem so far, I should use the Membership provider and so on. Now comes the problems.... I have to create other web site, accessible from the main one without asking for user credential. This site has to do the login silently or show again the login form if the user is not authenticated.

I think I have to use DotNetOpenAuth and OpenId authentication in some way, but I've spent some days searching the internet without find any starting point. All sample uses Google or Facebook but is not my case....

Basically....

1. User log in in to main web site.
2. click a link to an external web site
3. the external web site "recognize" that the user is already logged and give access

I'm really confused about OpenId and hope that someone can give me some hints.

Any help will be really appreciated

Thanks!

Answer 1

It sounds like you want to become an OpenID provider (http://openid.net/add-openid/become-a-provider/). Search for OpenID provider libraries. Once you implemented an OpenID provider, each external website will need to implement OpenID using an OpenID relying party library.

Answer 2

If you have the flexibility, I would also suggest looking into MVC4, it has built in support for ClaimsIdentity's which can provide better support for external authentication using things like OpenId, OAuth, Single Sign On (SSO) and Federated Authentication. I'm in the process of trying to implement this in my app so I'm still learning. I'm also still trying to research Windows Identity Framework (WIF) But I'm still unsure of the it's role in all of this stuff. This isn't so much of an answer is as it is a new line of approach I thought you might benefit from as well.

Answer 3

DotNetOpenAuth can offer the OpenID Provider functionality you need. And there are Provider samples available from Sourceforge. Look for the OpenIdProviderMvc sample.

Considering that what you want is an SSO login experience between two related web sites, I suggest you study the DNOA samples with "SSO" in their names.

Answer 4

I'm not sure about the scale of your project or it's scope. If its only about two websites and few traffic then implementing an identity provider (OpenID Provider) is an overkill. Instead you can look into a simple method such as this http://www.youtube.com/watch?v=1u7-sBadfW4 .

However if this is going to be something more than just two websites, its always better to be sticked to Open Standards as that will give you advantages such as security, scalability, interoperability etc. But still there are free and open source openID providers you can download and get start working (http://wso2.com/products/identity-server/)