SSO, the unknown [closed]

问题:

Closed. This question needs to be more focused. It is not currently accepting answers.

---

Want to improve this question? Update the question so it focuses on one problem only by editing this post.

Closed 6 years ago.

Improve this question

I'm starting to work on a SSO solution for 3 different webapps we've produced and still maintain for the same client.

Thing is, all 3 store their users and login information in the same place through a fourth separate application which provides just basic restful api services. Which basically means that when one tries to log into, we actually call the rest service asking whether this username and password are correct.

In a way this fourth restful thingie already does at least half of the job we need.

What we need now is a way to let users log into webapp A, then follow a link (or simply type its url) to webapp B (or simply type its url) and get there already logged (or viceversa).

I've been reading a lot about CAS and openID or even oauth but can't really make up my mind about it. Is this pattern centralized? Decentralized?

My ten-thousand foot view suggests I would somehow just need to add this "missing feature" to our restful api server.

But how?

ps: these 3 are completely separated. deployed on different machines (2 of them run on glassfish, the other one runs on tomcat). different domains too.

pps: they're all spring-driven webapps (hence they use spring-security)

ppps: as of today, there are other webapps using our restul api (non spring, non java). this sso solution might have to be ready to handle those too.

回答1:

Yeah it sounds like you need a "true" single sign on system rather than just a centralized credential repository. As you mentioned there are several options:

1. OpenId - more suited to an internet type application in which you want to allow users to log into your systems with credentials that are maintained by a third party. Stackoverflow is a classic example. You can sign in with your google account etc.

2. Oauth provides Pseudo authentication and sso - whereas OpenId says "this is user x" oauth says "this user has access to x's information" ... so you can assume that the user is x.

3. CAS, Cloudseal, OpenAM etc all provide true single sign on and are suitable for an intranet or extranet environment. CAS and Cloudseal have especially good Spring support.

回答2:

• Trusted site (relying party (RP) in white list - app a,b,c in your case) make request (redirect) to main site (provider - "fourth separate application") with a return url.
• Main site make sure request (returnURL) is from white list of domains
• Log user (if not logged, displaying login form), mark user as logged in database and add temporary token to user database.
• Main site return (redirect) to RP with token.
• RP look into database using token, logs user and deletes token.

SSOff also easy: just check on every request into user database into bool record (userLogged). NO REDIRECTS. On logout simply change record (userLogged) to false and every site will know.