As always, it depends. SSO is not trivial - as you undoubtedly know. The extensible authentication chain in EPiServer can be used to authenticate users in other systems, and give them roles in EPiServer based on information in the other system. Making another system recognize a login done in EPiServer is another ballgame. I think I've read that Community Server has a provider based authentication system, and/or can also run securly as long as the HttpContext.User is set to an authenticated user. If you can manage to get community server to run in the same (web) context as EPiServer, this might actually work. You can then create groups in EPiServer with the same name as the roles Community Server uses to grant access to the forums etc. The version I've used uses IsInRole to check access rights, and that would be ok if the user is an EPiServer extranet user. Another option is to rewrite the login logic slightly, and create a domain wide cookie of some sort, and do something with this in the other applications, if they run in different contexts. An httpmodule that checks the cookie, and logs you into Community Server automatically is one option. Beware not to create any unintentional backdoors or gaping security holes in the process :-) /Steve