Well the mechanics of signing in are basically 2 steps the lookup/validation and the setting of the FormsAuthentication cookie which is what makes a user signed in. Web apps can only set cookies in their own site host name so if both mojo and your app are in the same host name then signing into one is the same as signing into the other assuming both apps have the same users synchronized somehow.

If the apps are under different host names signing into one does not sign into the other because they can't set cookies for each other only for themselves. Security features of both the browser and the server prevent different sites from setting or reading each other's cookies.

Hope it helps,

Joe

I don't think you need to worry about the role provider.

Are you having any problem where the roles are not available after the user signs in?

The Roles Cookie is set using a custom forms authentication ticket simply as a means to encrypt it the same as the actual authentication cookie.

If the user is authenticated I "think" the role provider will create this cookie for you automatically. But if roles don't seem to work using your custom authentication then you can copy the role cookie code from the role provider and use it in your custom authentication.

Hope it helps,

Joe