title: SharePoint 2010 - two web applications - single sign on --> do I need claims based auth.?
body: <p>We are planning to create two sharepoint web applications using SharePoint 2010 Enterprise Edition.
  All Users that have access to web app 1, should also be able to access web app 2.
  This authentication shall be powered by server 2003 active directory.</p>
  
  <p>--> do I need to use claims based authentication?
  If so --> can I use Windows Based Authentication with NTLM for that?</p>
  
  <p>The only thing I really want is that users navigating from web app 1 to web app 2 (and vice versa) do not have to authenticate twice.</p>
  
  <p>I do NOT want to configure Kerberos if it is not absolutely necessare though...</p>
  
  <p>Can you give me any hints?
  Thanks!</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>ok - I'll try to be more precise:</p>
  
  <p>In our SharePoint 2010 environment, we've got two web applications running </p>
  
  <p>http(s)://humanresources.domain.com
  http(s)://sales.domain.com
  Both are running on the same IIS and have host headers configured (with wildcard domain certificate for HTTPS).</p>
  
  <p>Both apps provide a link to the other web application (sales -> humanresources and humanresources -> sales)</p>
  
  <p>Now whenever someone logged in to sales navigates to humaresources, I do not want that that person needs to login again. Therefore I thought I would need claims based authentication???...</p>
  
  <p>Please enlight my brain! :D</p>
  
  <p><strong>EDIT 2:</strong></p>
  
  <p>Thank you for your answers!</p>
  
  <p>@Panagiotis Kanavos - yes we have Users accessing the site from outside our environment: 1) Users which have an AD accound and are working on their laptops outside of our building (e.g.: they have been all day at a customer and are working at home for the remaining hours) 2) We plan to have users without an AD Accound --> Forms Based Authentication: (e.g.: customers accessing our TFS 2010 project protals to get an overview of the project). As far as I know, if you want FBA and WIN-Auth you need to configure Claims Based Authentication...</p>
  
  <p>However configuring a Web Application with Claims Based Authentication did not work. I chose "Enable Windows Authentication" together with "Integrated Windows authentication -> NTLM" as we do not have Kerberos configured (and I'd love to leave it like that ;-)).</p>
  
  <p>However the Users could not login to that application sometimes, and five minutes afterwards it worked. Additionally, when I added permissions to an AD user, SharePoint seemed to save the Token instead of the Group-/Account Id:
  e.g.: Instead of MyDomain\user1 it saved something like "0|=MyDomain\user1" and for groups it even only saved weird character strings "022-12.3"</p>
  
  <p>Could it be the case, that my 2003 windows AD does not support that?</p>