Note that there are some explanatory texts on larger screens.

plurals
  1. USJohn Mc
    primarykey
    data
    text
    plurals
    1. COIn response to your answer, the main application has a dedicated STS and only trusts tokens from there. The secondary application also has a dedicated STS and only trusts tokens from there. If both STS are based on different certificates, then how can this behaviour be correct?
      singulars
    2. COThanks for your reply. The main application STS uses Forms authentication and asks for a username and password, then retrieves the roles from the DB and populates the Roles as Claims in the Token. The secondary application only uses Windows Authentication, and as such any user coming in through it should have restricted access. It is essentially a quick access lookup application. The problem I am trying to solve is that when the user logs into the main application, the roles are populated into the claim for the secondary application and the user can do far more than they should be able to
      singulars
    3. COThe problem is that the Tokens are different and should essentially be treated as being completely independent. Changing the Claim type in one token should not affect the other, but this is what is happening. I would have thought that signing the tokens with different certificates would ensure that this is the case. The subset application is a separate application which is hosted in a different virtual directory to the main application. It offers a subset of the functionality available in the main application.
      singulars
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload