title: SSO using Windows Identity Foundation and WCF
body: <p>We have a client with following existing product line</p>
  
  <ul>
  <li>Website1 (Uses form authentication using user information stored in SqlDB for website1)</li>
  <li>WebSite2 (Uses form authentication using user information stored in SqlDB for website2)</li>
  <li>WinApplication1 (uses Active Directory to authenticate user)</li>
  </ul>
  
  <p>More products in line for future release.</p>
  
  <p>They want to implement Single Sign on (SSO) for all their products with following features-</p>
  
  <ul>
  <li>Product list that will be accessing by a user will be depended on his/her role. 
        It should be configurable. Roles are being defined in DB having Fk relation 
        with user table.</li>
  <li>SSO service should be flexible to accommodate new product.</li>
  <li>should use SAML to sucure token.</li>
  <li>WinApplication1 has link for website1 and website2. If an user is login in WinApplication1
        and click on any links of website1/website2, user should able to access the sites without
         entering his credential.</li>
  <li>If user is logned in in any product that user should be all to access any other product
        he has access right without enterting userid/password. </li>
  </ul>
  
  <p><strong>We have following query</strong></p>
  
  <ul>
  <li>We are planning to implement SSO using WCF and WIF. Can all above requirement be fulfill
        by using WIF.</li>
  <li>We want to keep user authentication part in respective product as each product has their
        own user store. OR WE SHOULD HAVE CENTRALIZED USER STORE?</li>
  <li>What shouldl be the responsibility of STS (implemented in WCF) in respect to SSO &amp;
        security?</li>
  </ul>
  
  <p>We have read lot about WIF from MSDN(<a href="http://msdn.microsoft.com/en-us/library/hh377151%28VS.110%29.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/hh377151(VS.110).aspx</a>, <a href="http://msdn.microsoft.com/en-us/security/aa570351.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/security/aa570351.aspx</a>) could not find any solid article/sample giving some practical scenarios. Most of them about using local STS…may be it is my bad luck.</p>