SSO from external web app to multiple LDAP (AD) providers

Question

Hi,

We are looking into a solution for this problem:

We host a ASP.NET web app externally on a dedicated web server which is on its own domain. We have a client who use the web app exclusively, and want SSO using their windows credentials to automatically authenticate into the web application without having to log on. This client has users on 3 different domains across the world, so some users might be on a UK domain, others on a USA domain, etc.

So far, I'm looking at a couple of options:

1) A custom LDAP membership provider that somehow can authenticate against these external AD sources. Not sure if this is possible yet...

2) CAS (http://www.jasig.org/cas) to create a central auth service, that can hook into the AD sources. Not sure if its going to be possible to hook CAS up to multiple AS sources.

Does anyone have any thoughts or similar experiences that they can share for achieving this?

Thanks

Answer 1

I've no experience with it but I think Active Directory Federation Services (ADFS) is designed for this sort of thing.