title: Secure Single Sign On in ASP.NET for the authentication from anthother (php) website via OpenID
body: <p>I need to realize a following authentication on my asp.net: the user on the ASP.NET and PHP websites should authenticated using the OpenID. The login and registration exists only on the PHP website. SO the requirements are:</p>
  
  <ul>
  <li>My ASP.NET website should redirect to the PHP website for the authentication. The user will
  authenticated using OpenID from the PHP website. </li>
  <li>If the user is new (I plan to use a coookie) to my ASP.NET website, it will redirects with empty
  paramater. Otherwise, I pass a stored OpenID in the redirect request.</li>
  <li>The PHP website shows the user the login page if the passed OpenID is empty and allows the user to  authenticate and register himself. If the passed OpenID is not empty. the PHP website should check its valid state.</li>
  <li>Only if the authentication / registration succeeded the PHP website redirects back to my ASP.NET website the OpenID, that I will use for the user.</li>
  <li>This process, of course, must be  secure.</li>
  </ul>
  
  <p>I found that the check for the authentication should be implement in the Global.asax in the Application_AuthenticateRequest event using the FormAuthentication. I plan it like this</p>
  
  <pre><code>protected void Application_AuthenticateRequest(Object sender, EventArgs e) {
    if(HttpContext.Current.User != null) {
      // Extract the forms authentication cookie if exists.
  
      // Redirects to the php website using the OpenID extracted from the cookies, or empty.
      // Pass also a new generated token to secure the communication.
  
    } else {
      // Store a new GeneralPrincipal to the HttpContext.Current.User.
    }
  }
  
  protected void Application_BeginRequest(Object sender, EventArgs e) {
    // Check for the redirected back token and OpenID.
  
    // Create FormsAuthenticationTicket for the openid and store it in the cookie.
  }
  </code></pre>
  
  <p>The problem is, that I can't save the generated token in the Session, because the SessionState is not initialized at the time.</p>
  
  <p>Which is the best practice to solve the requirements above?</p>