{"action":"closed","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1493","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer4","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1493/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1493/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer4/issues/1493/events","html_url":"https://github.com/IdentityServer/IdentityServer4/issues/1493","id":255416541,"number":1493,"title":"[Question]: How to implement SSO?","user":{"login":"yarsiemanym","id":5326862,"avatar_url":"https://avatars1.githubusercontent.com/u/5326862?v=4","gravatar_id":"","url":"https://api.github.com/users/yarsiemanym","html_url":"https://github.com/yarsiemanym","followers_url":"https://api.github.com/users/yarsiemanym/followers","following_url":"https://api.github.com/users/yarsiemanym/following{/other_user}","gists_url":"https://api.github.com/users/yarsiemanym/gists{/gist_id}","starred_url":"https://api.github.com/users/yarsiemanym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yarsiemanym/subscriptions","organizations_url":"https://api.github.com/users/yarsiemanym/orgs","repos_url":"https://api.github.com/users/yarsiemanym/repos","events_url":"https://api.github.com/users/yarsiemanym/events{/privacy}","received_events_url":"https://api.github.com/users/yarsiemanym/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-09-05T21:37:13Z","updated_at":"2017-09-06T04:29:54Z","closed_at":"2017-09-06T04:29:54Z","author_association":"NONE","body":"Hi all,\r\n\r\nI have a number of legacy .NET Framework web apps that use .NET Membership and Forms Authentication.  They each have their own login pages but they are all on the same domain (e.g. <app-name>.mycompany.com), share an ASP.NET Membership database and share a machine key so they are able to recognize each other's cookies to achieve SSO; i.e. if you log into one app then you're logged into them all, same with logging out.\r\n\r\nNow I want all future apps to be developed in .NET Core and use a common Identity Server as a centralized authentication mechanism.  I have a simple Identity Server up and running as well as a couple different flavors of .NET Core client apps.  All this works great.  The hurdle I can't seem to get over is SSO among all the mycompany.com apps.  @brockallen recommended [here](https://github.com/aspnet/Identity/issues/1405) that I take a look at the client samples for inspiration.\r\n\r\nThe `MvcFormPostClient` sample get me most of the way there.  I'm able to port my legacy apps over to ASP.NET Identity and manually implement OIDC, but it's not true SSO.  Currently, if I log into app1.thirdparty.com, then I am redirected to identityserver.mycompany.com for authentication.  After I login to identityserver.mycompany.com then I gain access to app1.thirdparty.com, which is great, but I also have to do this same process for each of the mycompany.com apps.  Granted I don't have to enter my credentials each time because I already have a session established with identityserver.mycompany.com but I still have to go to each app and click the login button before I'm officially  logged in.  I'd prefer that logging into identityserver.mycompany.com initiate SSO with all of my other apps within the mycompany.com domain.\r\n\r\nIs this possible?  How would I go about it?"}}
{"actor":{"display_login":"leastprivilege"}}