Single sign on inside asp.net mvc web application

Question

I have two domains ,on our internal network:-

1. DomainA
2. DomainB

Both domains can communicate with each other's, but they do NOT trust each other.

So currently I have deployed my asp.net MVC web application inside domainA on IIS, but I need users who are on DomainB Active directory to be able to login to the asp.net mvc using their domainB AD credentials . I am open to both windows authentication and form authentication inside my asp.net mvc .

But the only requirement that came from the client is that they want users who access the asp.net mvc intranet application from their machine on domainB, to be able to lo-gin to the system without having a login page; they can either:-

1. enter the username and password through the browser pop-up,
2. or to sign in automatically.

So can anyone advice what are the approaches I can follow, to achieve this? Thanks

EDIT I have read the following article http://msdn.microsoft.com/en-us/library/ff650307.aspx , about how i can authenticate asp.net mvc users from multiple domains, so inside my asp.net mvc i did the following :-

I added the following to my web.config:-

<system.web>
    <membership>
      <providers>
        <add name="TestDomain1ADMembershipProvider" type="System.Web.Security.ActiveDirectoryMembershipProvider" connectionStringName="TestDomain1ConnectionString" connectionUsername="ad-domainA.intra\it360ad.user" connectionPassword="$$$$$" />

      </providers>
    </membership>

&

<add name="TestDomain1ConnectionString" connectionString="LDAP://ad-domainA.intra/CN=Users,DC=ad-domainA,DC=intra" />

and i added the following Account.controller:-

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult Login(LoginModel model, string returnUrl)
{


    MembershipProvider domainProvider;

    domainProvider = Membership.Providers["TestDomain1ADMembershipProvider"];


    // Validate the user with the membership system.
    if (domainProvider.ValidateUser(model.UserName, model.Password))
    {
        // If there is a RequestUrl query string attribute, the user has
        // been redirected to the login page by forms authentication after
        // requesting another page while not authenticated.
        if (Request.QueryString["ReturnUrl"] != null)
        {
            // RedirectFromLoginPage sets the authorization cookie and then
            // redirects to the page the user originally requested.
            // Set second parameter to false so cookie is not persistent
            // across sessions.
            FormsAuthentication.RedirectFromLoginPage(
                model.UserName, false);
        }
        else
        {
            // If there is no RequestUrl query string attribute, just set
            // the authentication cookie. Provide navigation on the login page
            // to pages that require authentication, or user can use browser
            // to navigate to protected pages.
            // Set second parameter to false so cookie is not persistent
            // across sessions.
            FormsAuthentication.SetAuthCookie(model.UserName, false);
        }
    }
    else
    {
      //  Response.Write("Invalid UserID and Password");
        ModelState.AddModelError("", "The user name or password provided is incorrect.");
        return View(model);
    }
    ////////////
    //if (ModelState.IsValid && WebSecurity.Login(model.UserName, model.Password, persistCookie: model.RememberMe))
    //{
        return RedirectToLocal(returnUrl);
    //}

    // If we got this far, something failed, redisplay form

}

But currently when the user try to login , he will get always the following message

•The user name or password provided is incorrect. 

so can you advice if my code is correct ?

Answer 1

You have to deploy a SSO solution like Active Directory Federation Services on a server that is joined to DomainB.

Then implement authentication in your application (for example, WS-Federation Passive Requestor) that targets that SSO solution and standard Windows Authentication that targets DomainA.