This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I am looking for some advice, not for code snippets etc but just some help with the right approach.
We have two projects, PA and PB that we created for different audience and purposes.
Now our clients realized that they can use both our apps after we implemented some integration between the two.
So the current situation is that some users only use PA, some only use PB, and some use both.
We are building a "dashboard project" where users can go and log in.
Requirement: once they log in, this dashboard is supposed to detect if their credentials are valid for PA or PB or both.
Problem: users most likely have different credentials for PA and PB, so one common login would not work.
Question: how would you approach this?? Is it even possible?? They're asking me to implement it but i have no clue how to achieve that...thx!
I would centralize the logins in another DB. Then use OAuth/OIDC for single sign on.
I guess that you could simply try both logins and see what you can access. But there many unknowns (for me) here, so my reply may be completely off base.
I was thinking to do that (like when you add accounts to your email client and then access gmail, hotmail etc from on app).
And then store the access tokens and use them to consume the APIs...?
It is unlikely you'll be able to programmatically figure out every matching user account between the two systems. Also there are unknowns. Do the schemas match, how are roles/claims are handled in each application, are the passwords hashed, etc. You could have more work to do depending on the answer these and other questions that pop up.
I would try the old 80% rule and get most of the existing population as possible. Handle the remaining as one-offs.
Centralize the user accounts and claims in a new database. This is a more modern less hacky approach and there are out-of-the-box OAuth libraries for dealing with SSO in .NET.
The user contacts an admin if the user feels they should have access to an application. It's the admins responsibility to verify and authorize the user. You can also provide login validation from the new login page to either of the older login stores. If the user can successfully login to an older login store then the user is granted access to that system in the new system. You might have to retire older accounts at some point.
Anyway, that's how I would approach the problem.
I realise now that we don't know what sort of credentials we are talking about.
Are they SQL logins?
Are they users that are authenticated by the application, and the application, as Tom says, logs into SQL Server?
Or are they using Windows authentication?
In the latter case, it would be as simple as I suggested. And as I mainly been working with applications which uses Windows authentication, this seemed natural to me.
But if they have a username/password for both applications, you will need to ask them supply both I guess. Or rework the existing solutions to use Windows auth.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 1%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETP%3C/text%3E%3C/svg%3E)
Normally, users do not login to the SQL Server. The APPLICATION logs into SQL Server as a generic user, and user security is handled by your APPLICATION, not SQL Server.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(262.40000000000003, 36%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELH%3C/text%3E%3C/svg%3E)
Hi @Stesvis ,
Maybe you can make the two databases trust each other,
or combine two databases into one database.
Best regards,
Lan Huang