SSO with asp.net identity and cookie sharing, should I check the security stamp with the SSO application in every request?
Suppose we have a SSO web application (for example login.company.com) that all users login through it and it sets a cookie for company.com that is used for authentication in all the systems on the subdomains of company.com, for example the human resources system (hr.company.com). The SSO web application uses asp.net identity.
Now we want that the system admin be able to logout the user of all of their sessions in all of the systems in the company, or the admin must be able to change the claims of a particular user and this change should be reflected in all the companies' systems.
Does this require that all the systems that use the SSO check the cookies security stamp with the main SSO web app? What is the best way to do this? Should there be a web service on the SSO web application so that the other web applications can check if the security stamp is valid in every request? How can we do it without affecting performance negatively?
Thanks a lot
Tiffany BurrisPosted Jun 5, 2024, 2:48 AM
Sorry. I have a wonder. How can the centralized validation service be designed to ensure high availability and fault tolerance in the distributed system architecture?
Jayraj ChhayaPosted Jun 4, 2024, 9:07 AM
In a scenario where multiple systems under the same domain share authentication cookies set by an SSO application using ASP.NET Identity, ensuring centralized session management and user claim synchronization requires careful consideration. To enable features like global user logout or claim updates, it is advisable to validate the security stamp with the main SSO web application in each request.
One effective approach is to create a web service on the SSO application that other systems can query to verify the security stamp's validity. By centralizing this check, you maintain consistency across systems without compromising performance. Implementing this validation mechanism helps synchronize user sessions and claims efficiently while ensuring security and integrity in a distributed environment.