3

I'm working on an MVC4 site using SimpleMembership to handle user accounts and role based authentication. We have another site and we'd like to implement a single sign on system allowing users from the existing site to log in to the one I am building. What would be the best way to achieve this and hopefully leverage to the existing roles based authorization I'm using on the MVC4 site. Is it possible to have multiple membership providers (i.e. use the built in one and if the user is not found, attempt to authenticate via a custom provider that I'll write (once I work out how!). Or would it be better to abandon the built in membership/roles and roll my own?

I also thought of letting WebSecurity check the local database and if the user is not found, query the 2nd database and if the users credentials are valid, create a local account for them. One issue with this approach is if a user called Fred registers on the MVC site, and then a user from the other site called Fred logs in, we couldn't create them a local account with the same username. We could prefix/suffix the username with some text to indicate that they are from the other site but then we lose the single sign on feature.

We will also want to integrate AD authentication for staff in the future.

So essentially I'm looking for the best way to authenticate users from multiple databases and keep using roles based authentication?

I've also done a little digging was wondering if ADFS might be useful for this.

Any help or advice would be greatly appreciated!

Stephen Marshall
  • 31
  • 3
  • I am facing the same problem. I think AD authentication have to be done in IIS, see here http://msdn.microsoft.com/en-us/library/ms972958.aspx And you have to overrid the login method so that it can call the first database then the second. – riadh gomri May 31 '13 at 13:38
  • Thanks there's definitely some useful info there – Stephen Marshall Jun 03 '13 at 15:04
  • These two links might help you: http://www.codeproject.com/Articles/429166/Basics-of-Single-Sign-on-SSO and http://garymcallisteronline.blogspot.com/2013/01/aspnet-mvc-4-adfs-20-and-3rd-party-sts.html –  Jun 09 '13 at 01:01

1 Answers1

1

I recommend the use of an Identity server to handle all your login request and switching to a claim based authentication instead of a role based authentication if you can.

I personally went with Thinktecture IdentityServer

pluralsight.com have a good course on it.

Thinktecture IdentityServer is build on top of simple Membership and it supports multiple protocol such as

  1. WS-Federation
  2. WS-Trust
  3. OpenID Connect
  4. OAuth2
  5. ADFS Integration
  6. Simple HTTP

I recommend checking it

Good Luck

Nerdroid
  • 13,398
  • 5
  • 58
  • 69