I am learning about the Thinktecture Identity Server v2 and considering deploying it as a single sign on solution for 3 to 4 apps/services our company is developing for our customers. The applications use a mix of ASP.NET forms, Web API and SignalR web sockets. User addition can only be accomplished by a trusted user adding another one.
After reading and watching for a few hours I have a few basic questions:
1) Do application servers require round trips to the authentication server on every request? If not then how does this work, do all the servers share a decryption key that is used to decrypt a token?
2) Why is this better than following an approach more like this: http://codebetter.com/johnvpetersen/2012/04/02/making-your-asp-net-web-apis-secure/. If I did this I would provide all my app servers (including the auth server) with an encryption key that would be used encrypt and decrypt tokens that could be stored as cookies or in local storage on the client browser. The auth server would just respond to my other applications as to whether an unauthenticated user's creds were good to create a token for. A request would be deemed authentic if the token decrypted to the right format.
Someone will invariably tell me that I need to read more, but I'm afraid of getting a week or two into deployment and finding out that its killing performance or something.