Passing parameter SecurityToken to a different asp.net mvc website in a POST doesn't work to allow Single Sing-On

Question

I have couple of websites A, B, C ..... Website A: is an authentication website, depending on the user name, password and an extra parameter; Website A redirect a successful user login to Website B. When the user is logged I get in the Website A a Token derived from System.IdentityModel.Tokens.SecurityToken. My first approach was trying to pass that Token to the other website via POST request but with no success because the token is too large. First I thought it was serializable but no: GenericXmlSecurityToken can be converted to XML using ToTokenXmlString(). This is an extension method on Thinktecture.IdentityModel.Extensions, below I am attaching the description of the class

public static class SecurityTokensExtensions
{
        public static ClaimsPrincipal ToClaimsPrincipal(this SecurityToken token, SecurityTokenHandlerCollection handler);
        public static ClaimsPrincipal ToClaimsPrincipal(this SecurityToken token, X509Certificate2 signingCertificate);
        public static ClaimsPrincipal ToClaimsPrincipal(this SecurityToken token, X509Certificate2 signingCertificate, string audienceUri);
        public static SecurityToken ToSecurityToken(this GenericXmlSecurityToken token);
        public static SecurityToken ToSecurityToken(this GenericXmlSecurityToken token, SecurityTokenHandlerCollection handler);
        public static SecurityToken ToSecurityToken(this GenericXmlSecurityToken token, X509Certificate2 decryptionCertificate);
        public static string ToTokenXmlString(this GenericXmlSecurityToken token);
        public static string ToTokenXmlString(this SecurityToken token);
        public static string ToTokenXmlString(this SecurityToken token, SecurityTokenHandlerCollection handler);
}

As you can see we can convert the XML to String but not of the methods above takes that string and returns a SecurityToken, instead they take GenericXmlSecurityToken. The constructor of that class is here and depends on more than one parameter.

https://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.genericxmlsecuritytoken.genericxmlsecuritytoken(v=vs.110).aspx

Questions:

1. Do I need to add something in my webconfigs to make this possible
   withouth a POST?
2. Can I Serialize the SecurityToken and POST it to Website B and Deserialize it again with all original values(which is the approach on this case).

Answer 1

The proper solution would be to use an STS that both websites use for authentication. Manually posting tokens around is a bit hacky.

That said - you can construct an GenericXmlSecurityToken from the XML string. IIRC you can simply pass null to all the ctor arguments that you don't know about.