浅谈谁都能看懂的单点登录（SSO）实现方式（附源码）

HttpCookie cookie = new HttpCookie(FormsAuthCookieName, encryptedTicket);
cookie.Expires = rememberMe "/";
cookie.Domain = "domain.com";
context.Response.Cookies.Set(cookie);

if (Domain.Security.SmartAuthenticate.LoginUser != null)
{
  //生成Token，并持久化Token
  Domain.SSO.Entity.SSOToken token = new Entity.SSOToken();
  
  token.User = new Entity.SSOUser();
  token.User.UserName = Domain.Security.SmartAuthenticate.LoginUser.UserName;
  token.LoginID = Session.SessionID;
  Domain.SSO.Entity.SSOToken.SSOTokenList.Add(token);

  //拼接返回的url，参数中带Token
  string spliter = returnUrl.Contains('"&" : "";
  returnUrl = returnUrl + spliter + "token=" + token.ID;
  Response.Redirect(returnUrl);
}

[WebMethod]
public Entity.SSOToken ValidateToken(string tokenID)
{
  if (!KeepToken(tokenID))
    return null;

  var token = Domain.SSO.Entity.SSOToken.SSOTokenList.Find(m => m.ID == tokenID);
  return token;
}

[WebMethod]
public bool KeepToken(string tokenID)
{
  var token = Domain.SSO.Entity.SSOToken.SSOTokenList.Find(m => m.ID == tokenID);
  if (token == null)
    return false;
  if (token.IsTimeOut())
    return false;

  token.AuthTime = DateTime.Now;
  return true;
}

if (!string.IsNullOrEmpty(tokenID))
{
  AuthTokenService.AuthTokenServiceSoapClient client = new AuthTokenService.AuthTokenServiceSoapClient();
  var token = client.ValidateToken(tokenID);
  if (token != null)
  {
    this.lblMessage.Text = "登录成功，登录用户："
      + token.User.UserName
      + "<a href='http://sso-server.com/logout.aspx"
      + Server.UrlEncode("http://sso-client.com")
      + "'>退出</a>";
  }
  else
  {
    Response.Redirect("http://sso-server.com/sso.aspx" +
      Server.UrlEncode("http://sso-client.com/default.aspx"));
  }
}
else
{
  Response.Redirect("http://sso-server.com/sso.aspx" +
    Server.UrlEncode("http://sso-client.com/default.aspx"));
}