Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service.

My thought is that a user will log in with a username/password to be sent to the authentication service. That service will return some kind of auth token that grants access to the other services bound by the privileges given to that user.

What are the best practices for securely designing such an infrastructure? Any resources you recommend for more in depth reading?

share|improve this question
If you're building a web-application, check out Microsoft Azure Active Directory. It allows federation of independent stores ... or at the least can be a model for what you're trying to do. – LamonteCristo Feb 7 '13 at 16:40

It sounds like you want something like Kerberos. The short version of what Kerberos does is it lets a single server be responsible for authentication and then generates a Ticket Granting Ticket for the user that can be used by the user for a period of time as proof that the user has verified themselves with the Kerberos server.

Services can then make a challenge against the TGT (ticket granting ticket) that the user has and the user can respond to the challenge to prove that they are the holder of the TGT and that the TGT originated from the Kerberos authentication service. Thus, the service knows to allow the user access.

share|improve this answer

Some folks at MIT, where the Kerberos authentication system was created, wrote a play, called Designing an Authentication System: a Dialogue in Four Scenes that describes in steps te various attacks that an authentication system can endure and how they are thwarted by Kerberos.

share|improve this answer

If you want SSO, there are a number of open source solutions, JOSSO, Gluu, CAS. etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.