c# - Multiple websites, Single sign-on design -

I have a question, a customer who I was working recently, has several websites with different login mechanisms She is slowly trying to migrate to the Single Sign-On system for her websites (all asp.net mvc .)

I see here on my options, here is a list of requirements:

1. It is to be safe (duh)
2. It needs to support more user-user qualities than normal, name, address stuff (such as money or credits for a user)
3. It must give a centralized user management web console for its convenience (I think it will be a small project at the top of the design design, I choose to go for it)
4. Repeat the entire product Without the need to integrate with existing websites (I think it depends on the existing product implementation).
5. The person has to deal with emailing when he registers (to activate his account)
6. User has to deal with activating, when he activates me In the email the link will click (I understand that 5 and 6 require some form for email templateing system so that different e-mails can be supported per app)

I want to create a library It was working which works in conjunction with form authentication, which requires methods (such as logging in, logout, active, etc.) and a small comfortable service to implement activation from email, registration process etc.

Considering the question that things have been left to load in brief and at this point, is it like a good design?

But this is a very common Problem problem Do you have any existing projects that I could use?

Thank you for reading.

The basic thing to understand is that you can not authenticate us using standard form authentication in many standard domains. For example, dev.google.com and www.google.com are separate domains and if a user enters dev.google.com, it does not automatically sign in to www.google.com, unless Google It does not have anything special to enable. The reason for this is that the browser can not access cookies from any other website.

The only way to sign cross domain signals at work is to include important values ​​such as session ID in the query ID, which sets the user's checkbox and user's authentication cookie, possibly through your site. Manually use a little bit of your own custom code.

Example:

The danger of this approach, though, is that someone can locate a user session that was used by the user and was checking session ID. Then you need to make sure that the value used to authenticate the user across the domain is time-sensitive and dynamic. Do not make it user's user ID or username or something like that.

Now, if the site is on the same domain, then you can give them the same machine, and then a user has already entered a site, while on different websites around the same domain Will not log out.