authentication integration issue

Question

Hello everyone,

I am using SharePoint 2007 Enterprise + Publishing portal template + Windows Server 2008. I am developing using VSTS 2008 + C# + .Net 3.5. I need to implement SSO (Single Sign On feature) with another site. The SSO protocol is like this,

1. The other site will send me information like http://mysitename/default.aspx?Identity=abc or like http://mysitename/default.aspx (mysitename is the site which I am developing);
2. If the value Identity variable is null, it means anonymous user. And if the Identity value is not null (means an authenticated user), I will using a WCF interface to find user information (e.g. user name and email address) from the Identity variable;
3. The actual user name, user profile (e.g. email address) and password are maintained by the other site;
4. My site will manage roles by myself (i.e. the other site and my site only shares user credential authentication function to implement SSO, role management are performed individually in two sites).

Any ideas how to integrate such SSO feature?

thanks in advance, George

Answer 1

The first thing you need to do is to find a way to verify that your application was called from a trusted site. This means that the username must be encrypted before sending it. So both sites could share private key used to encrypt and decrypt sensitive information.

1. SiteA encrypts username using a key and sends it to SiteB (your site)
2. SiteB decrypts username using same key and retrieves user profile.