在子域上对用户进行身份验证并保持在父域上登录？

Question

I have two sites: www.forums.mysite.com and www.mysite.com

The forums already has authentication set up and I'd like to use it.

I'm using C# MVC .NET 4.5

I have created two sites in IIS 8.5: mysite and forums

mysite bindings:

• Type: HTTP
• IP address: All Unnasigned
• Port: 80
• Host name: www.mysite.com

forums bindings:

• Type: HTTP
• IP address: All Unnasigned
• Port: 80
• Host name: www.forums.mysite.com

I have also added the domains to my host file :

• myip www.mysite.com
• myip www.forums.mysite.com

I have added the MachineKey to both applications Web.config files and the keys are identical:

<machineKey validationKey="C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE" decryptionKey="8A9BE8FD67AF6979E7D20198CFEA50DD3D3799C77AF2B72F" validation="SHA1" />

In the controller of the subdomain (Forums), a user logs in and I have modified the cookie as follows:

FormsAuthentication.SetAuthCookie(username, model.RememberMe);
var cookie = FormsAuthentication.GetAuthCookie(username, model.RememberMe);
cookie.Domain = "mysite.com"; //this is the parent domain
//I've also tried with .mysite.com
Response.AppendCookie(cookie);

I can log in via the forums but then when I go to the main site (mysite.com), I am not logged in... I don't understand why not.

As a test in mysite.com/home/index.cshtml (the home page), I have added this:

<h1>
  Logged in:  @User.Identity.IsAuthenticated
</h1>

but the result is always false, even though both sites have the same .ASPXAUTH cookie...

Any ideas?

Answer 1

Probably, domain should be .mysite.com (leading dot), not mysite.com .

Upd.

Also, problem may be with leading www in your's domain names. Try set cookies domain to www.mysite.com or .www.mysite.com (or eliminate www in your's config, its just an archaic junk :))

Upd. 2

Looks like there is problems with setting cookies for parent domains (take a look at this , for example), which is understandable, from some point of view.

Can suggest only following:

1. On user-login in subdomain, take auth data.
2. Serialize auth data and send it to parent domain to some script like www.mysite.com/keep-logined?c=<encoded_auth_data> .
3. In that keep-logined script unserialize auth data and manually set cookie for root domain.
4. Redirect user back to subdomain, (can supply keep-logined script with redirect-back url.

Note: make sure to protect that keep-logined script and supplied auth data from hacking by some sort of encoding or key-passing.