I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure.
Users to land on a central auth server which performs credential verification, creation, and change. Once verified, the user will be auth'd for their correct subdomain and none others. E.g. Client Foo has several employees. The employees all login through the central server and are then sent to Foo's subdomain. The subdomains are for isolating large clients and for crude load balancing.
It is to operate like so:
- User lands on
- User provides username, password, and subdomain (say,
- central auth service verifies credentials
- Response contains
sig(and a timestamp??)
- User constructs a
https://foo.example.com/loginwith relevant data, described later.
sig is constructed thusly:
The document to be signed is user's ID and a timestamp in
yyyyMMddHHmmssformat joined with a comma. For example, for ID 55555 and timestamp 20140620132430, the document string is
The central server signs the documents with its private key. Each subdomain has the corresponding public key so they can verify that the signer was the central server.
Relevant data passed to the subdomain's login (or auth??) service would be:
- User's ID
- timestamp for request generation time. Verified by receiver to be current.
- Site (subdomain)
sig(base64 encoded -- not sure why that matters...).
It's not clear to me that the client/User is the one constructing the
POST to the subdomain. The central auth server would of course have all relevant data to send to the subdomain and could construct the
POST itself. Then I've got to deal with how to get the user over to the correct subdomain with the correct token or cookie or something.
Does this amount to "rolling my own" auth protocol?
Would an existing standard protocol cover my use-case?
What's wrong with the above? I keep thinking it's all wrong---that it's a potentially bad answer to the wrong question; that we should rethink what we're trying to use subdomains for.
If the basic idea is sound, am I missing anything? Or does anything else need clarification?