Possible to reuse logged-in Sharepoint authentication?

Question

Looking for a pointer in the right direction ...

Is there a mechanism which allows you to configure SharePoint in such a way that:

if a user has been successfully authenticated within a SharePoint site that there is some kind of "authentication token" what can be passed or is available to 3rd party sites

or a way for 3rd party sites to "recognize" that the user is currently authenticated within a sharepoint environment

all 3rd party apps can be modified to accommodate whatever needs to be done but the constraint is: SharePoint may or may not be a hosted (by a separate service provider) and how the original authentication took place is irrelevant i.e. just need to know they authenticated ok, not how

EDIT scenario to help clarify: authenticated SP users require access to a 3rd party service provider for additional content. a "link" on their SP site redirects through to the 3rd party. the 3rd party needs to recognize the referrer (based on a collection of evidence supplied by the request) so that it need not challenge for a secondary authentication process.

one of the 3rd parties is me. the SP instances are many and varied and would be any one of my clients (which i don't offer support to, just provide a content service to).

so the attempt is to solve more of a general "community/ecosystem" problem.

Answer 1

Your question is very confusing.

SharePoint may or may not be a hosted

What do you mean by that?

Are you invoking a 3rd party web app from a SharePoint page? You can get the current user using

SPWeb.CurrentUser

property and make use of it.

NLV

Answer 2

Your requirements are a little vuage but this should point you in the right direction.

Plan authentication methods (SharePoint Server 2010)

Specifically Claims based authentication.

Answer 3

Going on the small amount of information available here.... You are probably going to use Windows Authentication (via Active Directory) or Forms based authentication.

If you are using AD within your organization and the other server you are authenticating to is using the same AD, it's a no brainer. If it's AD based but both servers are using different domains, it's much more complex. One option would be to setup a trusted share between the ADs.

If you are using Forms Based authentication it becomes a bit more of an issue. If both servers are using the same FBA, you could create the authentication cookie in SharePoint and then add the cookie as a header to a Request object and then redirect to the server.

If they are different authentication methods totally, you need to determine if your security requirements will allow users to authenticate via some URL based mechanism (like querystrings) and then develop the logic on your SP box to create the URL to authentication.

Answer 4

I'm guessing that by "3rd party sites" you mean sites that aren't hosted in your domain. If that's the case, then the servers won't be able to use your AD authentication (unless you share them, which probably isn't worth it).

I would suggest modifying the way users are authenticated on the 3rd party servers, as you have control over how you send your users over there. You could easily encrypt their usernames/emails/unique IDs and a timestamp (to make sure they can't bookmark that link) in a query string.

The information is then decrypted on the 3rd party server. Invalid information and they are redirected to your login page. Valid information and the 3rd knows that they were authenticated in your sharepoint app.