Monday, 19 August 2013

MVC single sign on with SSL across both sites

MVC single sign on with SSL across both sites

After checking other SO questions I have single sign on (SSO) working.
There are two MVC 4 applications hosted on the same machine with the same
domain (foo.example.com and bar.example.com).
Now I would like to get this working so both sites are under SSL for all
of their traffic (without writing my own authentication handling as in
this example).
I have worked out how to create self signed certificates in IIS7 and tried
using one certificate for both sites and also having a separate
certificate for each site.
After trying various configurations I am starting to believe it is not
possible. I understand that SSO works by passing the authentication cookie
between the applications when the web.config has been set up correctly
with matching machine keys.
If the two sites are under SSL does this premise break down because of the
encryption inherit in SSL? If it is possible I haven't worked out how to
set it up.
If it is possible how do I do it:
One SSL certificate for both sites?
Two different SSL certificates?
If it is possible how do I set up IIS?
Any experience with this situation would be appreciated.

No comments:

Post a Comment