Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Scenario :

  1. Application a.mydomain.com redirects its users to application b.mydomain.com for Account Creation.
  2. b.mydomain.com creates the account, and redirects the user back to a.mydomain.com with the encrypted Username (+ Timestamp).
  3. a.mydomain.com reads it and displays on its form.

Constraints :

  1. Cant use it as GET parameter since no logging needs to be done.

  2. Cant set it in cookie as mydomain.com already uses plenty of cookies.

  3. HTTP Post form submission to a.mydomain.com is not possible due to restrictions of the internal development framework.

Can anyone please suggest what should be the ideal approach to send the Encrypted username (+ Timestamp) back to a.mydomain.com

share|improve this question
Need more details, what server platform are you using? If it is IIS, have you considered having a common application pool handle both application folders? Are the subdomains on different machines or just different sites? Are they even on different sites? – AJ Henderson Jan 16 at 17:02
This also may be more of a server fault or web developers question since this is more of a "how to move data between sites" and the fact it is encrypted is pretty much secondary. – AJ Henderson Jan 16 at 17:03
AJ : They are all together different setup ( Our webserver cant talk to their webserver). I dont see any option to move this thread to Server fault, care to explain ? – Novice User Jan 16 at 17:10
AJ : We are using Apache at webserver level and prioprietory framework at App Servers. – Novice User Jan 16 at 17:12

1 Answer

up vote 3 down vote accepted

First and foremost do not write your own protocol for this! Other people have this exact same need and they use oAuth!

If you just need to know that they are connected an oAuth 2-legged is perfect. If you need to share more information about this user then use 3-legged oAuth.

share|improve this answer
1  
Wouldn't OAuth depend on POSTing to a? Or is it that a can POST to B and get the response back? I'm not that familiar with the actual mechanics of OAuth at that level. – AJ Henderson Jan 16 at 17:16
@AJ Henderson a subdomain can initiate an oAuth 2-leg request. If you don't know why, you need to read about oAuth, i don't know why you would suggest anything else. – Rook Jan 16 at 17:28
yeah, I just couldn't remember the exact mechanics of OAuth and if that ran afowl of any of his (somewhat odd) requirements. I did mention OAuth in my answer as it's the ideal if their environment will allow it. It sounds like they want the user to interact with B which means B has to communicate back to A somehow. I thought that was through a post back to A. – AJ Henderson Jan 16 at 17:34
@Rook : This indeed looks like a good approach. Thanks ! – Novice User Jan 16 at 17:50
@Rook - err, nm, I just think I figured it out. A just produces a token and asks B to authorize the token for access. B then handles producing the account with the user and grants the access, then when the user returns to A, A can use the token they have on file to request the account from B. Is that correct? – AJ Henderson Jan 16 at 18:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.