Central authentication

Question

I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service.

My thought is that a user will log in with a username/password to be sent to the authentication service. That service will return some kind of auth token that grants access to the other services bound by the privileges given to that user.

What are the best practices for securely designing such an infrastructure? Any resources you recommend for more in depth reading?

Answer 1

It sounds like you want something like Kerberos. The short version of what Kerberos does is it lets a single server be responsible for authentication and then generates a Ticket Granting Ticket for the user that can be used by the user for a period of time as proof that the user has verified themselves with the Kerberos server.

Services can then make a challenge against the TGT (ticket granting ticket) that the user has and the user can respond to the challenge to prove that they are the holder of the TGT and that the TGT originated from the Kerberos authentication service. Thus, the service knows to allow the user access.

Answer 2

Some folks at MIT, where the Kerberos authentication system was created, wrote a play, called Designing an Authentication System: a Dialogue in Four Scenes that describes in steps te various attacks that an authentication system can endure and how they are thwarted by Kerberos.

Answer 3

If you want SSO, there are a number of open source solutions, JOSSO, Gluu, CAS. etc.