CODEWITHSUNDEEP
wifwindows-identitysts-securitytokenservice
shary
shary

Reputation: 178

Federated authentication cookieless STS

I see that Federated Identity stores Security token to a cookie, after its first request to the STS (Security Token Service). In that case if I disable cookie in my browser, how does it work?

I have seen that it did not redirect to my STS issue App, how i can overcome this situation?

Upvotes: 1

Views: 440

Answers (1)

Peter
Peter

Reputation: 3956

I am not sure if I fully understand your question. I think you are mixing up some names.

On every login the Security Token Service (STS) stores the according site in a cookie. Therefore it is possible to log off on all sites you are logged in. But the cookie on the STS is not necessarily needed for a successful log in.

The WSFederationAuthenticationModule (at the relying party) stores the current session in a cookie. This is needed to associate a session with the correct user (i.e. to identify a logged in user on a new request). If cookies are disabled in the browser no login is possible. But the same applies to the default FormsAuthenticationModule in ASP.NET.

Upvotes: 2

Related Questions