How to solve a general authentication problem for multiple applications?

Question

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites each have their own membership implementation. Some use a custom provider we wrote, some use Asp.Net membership.

Yes, we have created a problem for ourselves. The question is how to fix it.

What would be the best (or at least good) solution for a authentication/authorization service that would allow us to consolidate sign in to one place? Should we implement an oAuth/xAuth provider? Something else?

Some questions I was thinking of:

1. Should roles be left to each application to implement? In general, we could think of each resource as having CRUD permissions and perhaps decorate controller actions with required permissions.

2. We have a few really, really legacy web apps (.Net 1.1) that mostly just sit there and run. Where should we draw the cutoff for what we apply this new service to?

If there's something else I should be considering, please let me know.

Answer 1

To answer the specific questions first:

1. Roles are always application specific. Unless your applications either have very, very similar role requirements or are very simplistic, I would not attempt to centralize role management
2. You should draw the cutoff at the point where the effort outweighs the benefits.

Now to the more generic question:

Since all your internal apps use AD already, I would probably go down the road of adding a separate entity in AD for "Guest Users", which could hold simple user accounts for all external users, and then upgrade all external apps to also use AD. In which case you can then use a centralised oAuth provider for single-login. And if your web apps are written on different platforms, then write a little frontend to expose the oAuth provider as a web service, similar to OpenID.