I implemented an SSO solution between multiple ASP.NET MVC applications hosted in the same parent domain (app1.domain.com, app2.domain.com, ...) using forms authentication and setting the domain property of cookies to web.config of all applications:
<forms
name="ssoauth"
loginUrl="/login"
protection="All"
timeout="120"
requireSSL="true"
slidingExpiration="false">
domain="domain.com"
/>
When you set the domain property for a cookie, this cookie will be automatically sent by the client’s browser to all applications hosted in this domain and it will be able to authenticate the user automatically.
SSO , :
foo.com . , foo.com, , .bar.com . , . : https://bar.com?token=ABC.- ,
bar.com, , , . cookie , bar.com.