Forms Authentication Across Applications
ASP.NET supports forms authentication in a distributed environment, either across applications on a single server or in a Web farm. When forms authentication is enabled across multiple ASP.NET applications, users are not required to re-authenticate when switching between the applications.
Configuring Forms Authentication Across Applications
To configure forms authentication across applications, you set attributes of the forms and machineKey sections of the Web.config file to the same values for all applications that are participating in shared forms authentication.
The following example shows the Authentication section of a Web.config file. Unless otherwise noted, the name, protection, path, validationKey, validation, decryptionKey, and decryption attributes must be identical across all applications. Similarly, the encryption and validation key values and the encryption scheme and validation scheme used for authentication tickets (cookie data) must be the same. If the settings do not match, authentication tickets cannot be shared. For information about how to generate values for the validationKey and decryptionKey attributes, see How To: Configure MachineKey in ASP.NET 2.0. (This topic applies to ASP.NET version 2.0 and to later versions.)
Note
Applications that run ASP.NET version 2.0 or later can share forms authentication ticket information with earlier versions of ASP.NET if you include decryption="3DES" in the machineKey element for each ASP.NET version 2.0 (or later) application.
<configuration>
<system.web>
<authentication mode="Forms" >
<!-- The name, protection, and path attributes must match
exactly in each Web.config file. -->
<forms loginUrl="login.aspx"
name=".ASPXFORMSAUTH"
protection="All"
path="/"
domain="contoso.com"
timeout="30" />
</authentication>
<!-- Validation and decryption keys must exactly match and cannot
be set to "AutoGenerate". The validation and decryption
algorithms must also be the same. -->
<machineKey
validationKey="C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE"
decryptionKey="8A9BE8FD67AF6979E7D20198CFEA50DD3D3799C77AF2B72F"
validation="SHA1" />
</system.web>
</configuration>
Note
You can omit the domain attribute of the forms tag if there is only one Web site on the server.
After an authentication ticket (cookie) has been issued, expiration of the cookie is tracked based on the Expires value in the cookie itself. If two applications have different Timeout attributes, the expiration date and original timestamp are retained through each cookie's lifetime. When a cookie is updated, the cookie's original expiration is used to compute the new expiration. The only time that the configuration Timeout value is used is when the cookie is initially created.
Forms Authentication and the Authentication Service
You can also authenticate users across applications by using the authentication service. The authentication service enables you to use forms authentication from any application that can send and consume messages in SOAP format. For more information, see Windows Communication Foundation Authentication Service Overview.
See Also
Tasks
How to: Implement Simple Forms Authentication