ASP.NET Forms authentication - Issue with single sign-on on Chrome and Firefox

Question

We have two ASP.NET v4.0 websites on same domain (two different virtual directories) and we plan to use forms authentication single sign-on between them.

To support single sign-on using forms authentication we are using same settings for forms authentication and machine key in web.config for both websites (as shown below).

<authentication mode="Forms">
<forms loginUrl="Login.aspx" slidingExpiration="true" timeout="28800" defaultUrl="Default.aspx" name=".MYAUTH"/>
</authentication>


<machineKey validationKey="xxxx" decryptionKey="yyy" validation="SHA1"/>

Single sign-on works on our local and QA environment on all browsers and also works on IE 9/10 on our staging server but for some weird reason does not work only on Firefox (v25) and Chrome (v31) on staging server. After logging in to first website when user is redirected to second website the forms authentication cookie is always null and user has to re-login.

I tried all suggested solutions (like setting the same path and domain name etc for forms authentication node in both web.config) but none of them helped.

My staging server is something like "ab-cd-ef.my.company.com" (notice multiple periods and hyphens in the server name). Has it got anything to do with the server name? I tried below combinations (none worked):

1. <forms loginUrl="Login.aspx" slidingExpiration="true" timeout="28800" defaultUrl="Default.aspx" name=".MYAUTH" domain=".my.company.com"/>

2. <forms loginUrl="Login.aspx" slidingExpiration="true" timeout="28800" defaultUrl="Default.aspx" name=".MYAUTH" domain=".company.com"/>

3. <forms loginUrl="Login.aspx" slidingExpiration="true" timeout="28800" defaultUrl="Default.aspx" name=".MYAUTH" domain="ab-cd-ef.my.company.com"/>

This think is killing me now. Any help would be highly appreciated.

Answer 1

As weird it may seem, this problem was solved after I restarted the server.

It now works without specifying domain in forms authentication setting in web.config (as both websites are on same server/domain with just different virtual directories).

Defies any logic. I hope it helps someone scratching his/her head.