ASP.Net Webforms和MVC（不同的数据库和域）中的单点登录

Question

I'm confused about my situation. I have separate applications (ASP.NET 4.0 Web Forms and ASP.MVC) deployed in different machines (and domains) and each has its own Users and Roles structures (separate MS SQL databases). MVC app is currently in early implementing phase. Web forms app works on production environment.

What I need to do is to implement SSO betweent these apps. I want to have automatic authentication - after log into asp.net web forms application I need to be authenticated by asp.mvc application side.

I know that the requirements to implement SSO via auth cookie is to have both application working on common database and domain (or sub-domain) but there are really no possibilities to have SSO with minimum effort in my case?

Currently I have 2 ideas:

1) use 3rd party tools (OAuth?) - but I didnt read about it yet

2) create some WCF serivces on Mvc side to authenticate users: Web forms app will send login and password (hash?) via wcf service (encrypted data) and mvc app will validate this data. After positive validation mvc app will start FORMS authentication for this login and password.

I'm not sure if any of my concept is possible and safe.

Do you agree any of these 2 concept or have any other suggestions about solution of my problem? I will be grateful for your help.

---

EDITED - explanation the need

Its our customer requirement - web form app is old and it currently works on production environment. It has own custom memebrship providers connected to Users and Roles MSSQL database tables. The new application will be written in asp.mvc 4 and will have own users registartion page and Users structures etc. It must be deployed on different machine.

Some Users of old application will be replicated (on start) in new application because they must see some functionalities of new appllication after log into old one. It must looks like from their point of view that new application is part (new module) of old web forms application. On the other hand, the new application has to be independent and will be some pool of users that they will use new app only. Both applications will be integrated in case of one business process only (orders synchronization via wcf or rest services).

---

Answer 1

We worked on some thing similar to your problem.But in my case the two domains are under the control of same AD server.By using the Cookie sharing across domains we are cross checking the SSO. Follow this Link

Answer 2

您可以使用IdentityServer3之类的方法来实现Idp（aka STS或OpenID提供程序），并选择一个数据库用户作为内部身份验证提供程序，并选择其他数据库用户作为外部身份验证提供程序。