Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My company owns a domain A.com , and subsdiary is on B.com

B.com redirects their users to A.com for accounts registrations. Post successfull registration , A.com logins that user ( User doesnt get to know this), creates a token and needs to pass that token to B.com so that B.com shows that user logged in.

What should be the correct way to pass this information to B.com as we cannot write cookie for them.

I was thinking of encrypting the token , and A.com and B.com decide the encyption to use. But are there any other better approaches to deal this issue ?

share|improve this question
add comment

2 Answers

You can have A.com create a random N-bit token used as a key in a keystore. Then A.com sends to the user a link to B.com containing this token in the clear. The user accesses B.com with that token, and B.com can contact "privately" A.com and retrieve data associated to it, whereupon A.com may invalidate the token so it can't be reused.

Given the short round-trip time (the links are all redirects which should be handled automatically by the user's browser), A.com could be justified in refusing token requests for tokens older than, say, 30 seconds:

user  --> B.com "log me in"
B.com --> user  "Go to A.com/logmein/$RANDOM1" { cookie B.com:RANDOM1 }
user  --> A.com "log me in"
(login procedure)
A.com --> user  "Go to B.com/loggedin/$RANDOM2" [START "A" TIMER]
user  --> B.com "my token is $RANDOM2 (and my cookie is $RANDOM1)"
B.com --> A.com "What about $RANDOM2:$RANDOM1?" [STOP "A" TIMER]

Now A.com has stored $RANDOM1 upon the first request, recognizes $RANDOM2 as of its own making, the timestamp is valid, so on the link A-B can flow all sort of secret information unbeknownst to the user.

share|improve this answer
add comment

Sounds like you could use something like the OAuth authorization framework. The OAuth authorization framework enables third-party applications to obtain limited access to an HTTP service and there are many libraries available so you dont really need to implement everything yourself.

See http://oauth.net/

share|improve this answer
    
Or SAML (apparantly 'or SAML' is too srort, so here is a bunch of garbage text lessening rather than increasing the value of my comment) –  atk Dec 15 '13 at 14:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.