StarterSTS Documentation

Customizing Single-Sign-On

StarterSTS can create a single-sign-on session with the user. This allows the client to use multiple web applications without getting asked for credentials again.

This is a feature you might want - or not. But there are also several ways to customize it.

Configuration

StarterSTS uses the ASP.NET forms authentication infrastructure to create and maintain a SSO session. The settings (especially the default timeout of 300 minutes) can be changed in web.config

<authentication mode="Forms">
  <forms name=".STARTERSTSAUTH"
         requireSSL="true"
         defaultUrl="~/default.aspx"
         loginUrl="~/login.aspx"
         cookieless="UseCookies"
         slidingExpiration="false"
         timeout="300" />
</authentication>

Confirmation screen

StarterSTS allows to insert a confirmation screen in every logon process. This way a user is notified when he logs into an relying part. This can help to fight CSRF attacks.

You can enable the confirmation screen by setting the requireLoginConfirmation attribute in starterSTS.config to true.

Removing the feature

To remove the SSO feature alltogether, set the DisplayRememberMe attribute on the login control at ~/login.aspx to false.