Mike

Did you ever fix this, looking for same solution also.

Cheers Paul

Hi Paul,

Unfortunately I struggled to get a decent implementation in place. I ended up manually creating a shared user context stored in a cookie by adding the login name and a hashed version of the login name (using a hash only known between the two domains - as the sites were internal to the company security wasn't the highest priority). The cookie's domain is then set to the broader domain.com rather than to any specific sub-domain to make it accessible site-wide. 

The secondary domain then retrieves the shared cookie from the request object and attempts to authorise the user by comparing the login name and the hashed login name using the same algorithm. This is done by creating a custom AuthorizeAttribute and overriding the AuthorizeCore() method to add your own authorisation (in my case the hash comparison). You can then use the OnAuthorisation method to peform any additional re-directs etc.

Create the shared cookie using a custom-built hashing alogrith known between both domains in one.domain.com

userDetailsCollection.Add("UserName", currentUser.LoginName);
userDetailsCollection.Add("CheckValue", SecurityHelper.Hash(currentUser.LoginName));

HttpCookie userCookie = new HttpCookie("SharedContext");
userCookie.Domain = ConfigurationManager.AppSettings["TopLevelSiteDomain"];
userCookie.Path = "/";
userCookie.Secure = false;
userCookie.Values.Add(userDetailsCollection);
Response.Cookies.Add(userCookie);

Implement a custom AuthorizeAattribute in two.domain.com

public class UmbracoAuthorizationProvider : AuthorizeAttribute
{
    private bool _authorize;
    private HttpContextBase _httpContext;

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        _httpContext = httpContext;

        if (httpContext.Request.Cookies["SharedContext"] == null)
        {
            return false;
        }

        _authorize = (AuthorizeUser());

        return _authorize;
    }

    protected bool AuthorizeUser()
    {
        string userName = SecurityHelper.Hash(_httpContext.Request.Cookies["SharedContext"].Values["UserName"]);
        string checkValue = _httpContext.Request.Cookies["SharedContext"].Values["CheckValue"];

        return string.Equals(userName, checkValue);
    }

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);

        if (filterContext.Result is HttpUnauthorizedResult)
        {
            //Perform unauthorised code
        }
    }                                                                                                                               }

I know this is by no means the most elegant or secure solution, but it seems to work for my intended purpose. I hope this sparks some ideas or possibly works for your own scenario.

Thanks,

Mike

is working on a reply...