Setting up FormsAuthentication after SSO authentication

Question

My ASP.NET MVC 4 application is protected by SSO (OAM) with an ISAPI filter running on IIS. When a request to my application is received, it is intercepted by ISAPI filter a

Answer 1

It's entirely reasonable to use FormsAuthentication cookies to track the logged in user in your application after they have been authenticated using a Single-Sign-On provider. You don't show it but I'm hoping that you are also getting some ticket that you can use to verify the signed in user out-of-band with the SSO provider and not simply trusting the username header.

What you may be seeing, however, is that the user is not signed out from the SSO provider when you sign them out of your application. Because of that, as long as they have a valid cookie for the SSO provider, they will remain signed in, i.e., the user will get automatically bounced back to your application from the SSO provider without any required authentication.

That's unfortunate, but normal.

If you truly want the user to be signed out, you'll need to make use of the centralized logout functionality. I haven't worked with OAM, but it appears that it does support this: http://docs.oracle.com/cd/E21764_01/doc.1111/e15478/logout.htm

Answer 2

I had to explicitly kill the session inside Session_Start if requested URL is logout URL. And then with next request (like from logout to login page again), it generates a new session and runs smoothly.

protected void Session_Start()
    {
        if (!Request.IsAuthenticated && !IsSignoutURL)
            AcceptSessionRequest(); //process local authentication

        else if (IsSignoutURL)
            RejectSessionRequest(); //kill the sessions
    }

For background on how SSO passes authenticated user's identity to my application, read my comment to tvanfosson's post.

The post remains opened for a better idea.