At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites each have their own membership implementation. Some use a custom provider we wrote, some use Asp.Net membership.
Yes, we have created a problem for ourselves. The question is how to fix it.
What would be the best (or at least good) solution for a authentication/authorization service that would allow us to consolidate sign in to one place? Should we implement an oAuth/xAuth provider? Something else?
Some questions I was thinking of:
Should roles be left to each application to implement? In general, we could think of each resource as having CRUD permissions and perhaps decorate controller actions with required permissions.
We have a few really, really legacy web apps (.Net 1.1) that mostly just sit there and run. Where should we draw the cutoff for what we apply this new service to?
If there's something else I should be considering, please let me know.