Asp.net forms authentication and multiple domains

Question

I have two domains, domain1.com and domain2.com pointing at the same asp.net website which uses asp.net build in form authentication. The problem is that even if the domains point to the same website the user only get authenticated for one domain at a time. So if he uses www.domain1.com first and then visits www.domain2.com it's the same website in the back but he only is authenticated for www.domain1.com. The same thing happens if he uses www and not www when visiting the sites.

This is what I use to login:

FormsAuthentication.RedirectFromLoginPage(username, cookie.Checked);

To check login:

User.Identity.IsAuthenticated

How can I make the user gets authenticated for all domains that points to the same website?

The authentication cookie, like most cookies, are stored by domain to avoid cross-domain pollenation and impersonation. Why would you want to do this? — Lazarus
Because sometimes you have multiple sites you want the user to be able to use seamlessly, without having to log into each one separately. — Zhaph - Ben Duguid
Why not follow the StackOverflow methodology and use an external authentication provider such as OpenID. — Lazarus
You'd still need a mechanism to transfer the ticket to the second domain, even if you use OpenID - when SO was using UserVoice.com for it's bug/issue tracking, I still had to log in there even though I was using the same OpenID provider on both sites... — Zhaph - Ben Duguid

Zhaph - Ben Duguid Zhaph - Ben Duguid · Accepted Answer · 2010-01-13T13:03:09

What you're after is a Single Sign-on solution.

As ASP.NET authentication is at it's heart generally cookie based, there are two things to look at:

Set your cookies correctly.
Bounce your users to the alternative domain during signup.

Looking at both of these in more depth:

1. Setting cookies correctly

You need to ensure that ASP.NET is writing the authentication ticket cookies to the root domain, rather than the explicit domain this is done using the domain attribute of the forms element:

<forms 
   name="name" 
   loginUrl="URL" 
   defaultUrl="URL"
   domain=".example.com">
</forms>

You should set your domain to ".example.com" - note the leading period - this is the key. This way requests to example.com and www.example.com will both read the cookie correctly, and authenticate the user.

2. Bounce users to the alternative domain

What we have implemented on a few sites that use a single sign on is a round trip login process. The user authenticates on the first domain, we encrypt the login details, and redirect them to a known page on the second domain, log them in there, and then redirect back to the original server.

This client side redirection is important - cookies are only written when there is a response back to the client, and the browser has to visit the second domain to actually see the cookies.

Other details to consider in this sort of set-up:

You probably want to have a timeout on the encrypted sign-in details - so that recalling that URL from the browser history doesn't automatically log the user in.
If the domains are on different servers, you will need to ensure that either the machine keys are configured the same, so that you can encrypt and decrypt the details correctly, or use some other shared key.
You will probably want to have a mechanism in place to recall the users ReturnUrl from the original server so that you can send them back to the correct place.

You could also take a look at "Forms Authentication Across Applications"

Asp.net forms authentication and multiple domains

3 Answers