I'm designing an authentication methods for my client/server system consisting of:
- a windows desktop client application (.NET)
- windows/linux servers (C++)
- one "security server" which authorizes the users and passes some tokens for single sign on to the other servers
A user would login providing username and a password to the security server with I think a simple hashing password + salt or some challenge-response algorithm. On successful login the returned auth token the user could present to the server that would automatically authenticate them.
Note: I know that I could just use SSL, but I would like to (for some reasons) Note2: The communication doesn't need to be encrypted by default (it would be in "half" trusted environment)
What I have found that the Kerberos looks quite similiar and it it seems that my security server would be a simplified Kerberos server.
I think I would need:
- authenication protocol (client-security server)
- algorithm for token generation and its verification
Any suggestions? Where to start?