Cross-domain authentication ASP.net MVC

Question

I have two different web application built with ASP.net MVC. This two application may not be running in the same server nor in the same domain.

I would like that if a us

Answer 1

I assume you cannot communicate between applications A and B using any shared store. (This could allow some shared session implementation).

The more industry standard way (OpenID Connect) of doing that is like some of the other answers have hinted at. I will try and give more details to get you on the right track.

Both application A and B should relay the authentication process to a trusted 3rd party (which could be hosted in withe A, B or a different application altogether) - Let's call it C

When the user arrives at either A or B (no matter that B has weird complicated URLs, she can always bookmark those) his request should contain an authorization token. If it doesn't, she is not authenticated and would be redirected to C and presented with some login mechanism - say user/pass form.

After successful login, she is redirected back to A/B (depending on where she came from) to complete what ever she was doing with the authentication token. Now, having the authentication token present she is authenticated.

If she is authenticated with A and then redirected to B, this redirect should contain the token as well, B would know how to trust that token.

Now, If he just opens opens up a new tab, B would not see any token, and so she would be redirected to C, only to be redirected back (she is already authenticated, remember?) to B with the token, and now all is good.

What I described is a common flow using OpenID connect, and if using .net, I really suggest using IdentityServer from Thinktecture to do the hard work for you and be your "C".

Another option, is to pay for such "C" hosted as a SaaS application - check out Auth0