I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we are about to implement is safe. And if there is another solution that we’ve ignored, I would love to see that.
For the purposes of this problem, let’s assume the following objects: - AUTH - this is the SSO auth box that holds people’s credentials and stores authorization details for other services - A - the first service (this is a front-end service) on a.com - B - the second service (backend only service) on b.com - C - the third service (backend only service) on c.com - U - the user accessing the above services
The workflow that I am trying to make sure is secure/sane is:
- U wants to use protected service A
- A redirects U to AUTH
- U signs onto AUTH
- AUTH redirects to A with a token identifying user U
- A wants to communicate to B, which wants to communicate to C on behalf of the user
- A sends a backend request (no browser session) to B with token
- B forwards that token to C
- C uses the token to identify user U
The reason why oauth doesn’t make sense to me is because AUTH, A, B and C are technically resources, so therefore each of them would have to be a provider and each would be a client to another.
What I’ve been thinking about as a solution is to use JWT (JSON Web Tokens). Upon authentication, AUTH would provide an expiring JWT as the token signed by a private RS256 key. Each service (A, B, C) can verify the authenticity of the token by comparing it against AUTH’s public key. Upon a request (i.e. A talks to B), B knows the user U and then can ping AUTH to check if U has access to B.
Am I missing something? I’ve always been told never to implement security protocols, so I’m hesitant to adopt this solution. However, I don’t know what would be the best way to handle this.