Authenticate all Subdomains in Multitenant Application

Question

I have built a Multitenant SAAS application. In this application the User can pick his preferred subdomain name during signup. When user logins to the main application i.e. app.example.com, I validate his credentials and then redirect him to his preferred domain i.e. client1.example.com

I am using Forms Authentication and trying to authenticate the user over the domain "example.com" by making following changes in the web.config.

<forms loginUrl="~/Login/Home/AuthenticateLogin" timeout="2880" protection="All" domain=".domain.com"/>

My understanding is that once authenticated over "example.com" user will be able to access any subdomain of (domain.com). But it seems this does not happen as expected. After successful login to app.example.com when I redirect him to client1.example.com it again shows the login page.

What am I missing here?

Answer 1

You need to configure the same machineKeyfor all applications that share the authentication cookie. See Generate a Machine Key for a Web Farm (IIS 7).

Also verify that the cookie is set when you log in, and that it flows to all the applications.

Answer 2

Okay, So after trying for so long I got to know what the real problem was.

Actually even after allowing subdomains to share authentication cookie it did not work because the SessionId was not being shared between the subdomains. My Application had outproc Session Configuration (Sql Server). To share SessionId between subdomains I had to make following entry in my web.config :

<httpCookies domain=".domain.com"/>

After this it worked like a charm.

Hope this helps someone in need.