I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we are about to implement is safe. And if there is another solution that we’ve ignored, I would love to see that.

For the purposes of this problem, let’s assume the following objects: - AUTH - this is the SSO auth box that holds people’s credentials and stores authorization details for other services - A - the first service (this is a front-end service) on a.com - B - the second service (backend only service) on b.com - C - the third service (backend only service) on c.com - U - the user accessing the above services

The workflow that I am trying to make sure is secure/sane is:

  1. U wants to use protected service A
    • A redirects U to AUTH
    • U signs onto AUTH
    • AUTH redirects to A with a token identifying user U
  2. A wants to communicate to B, which wants to communicate to C on behalf of the user
    • A sends a backend request (no browser session) to B with token
    • B forwards that token to C
    • C uses the token to identify user U

The reason why oauth doesn’t make sense to me is because AUTH, A, B and C are technically resources, so therefore each of them would have to be a provider and each would be a client to another.

What I’ve been thinking about as a solution is to use JWT (JSON Web Tokens). Upon authentication, AUTH would provide an expiring JWT as the token signed by a private RS256 key. Each service (A, B, C) can verify the authenticity of the token by comparing it against AUTH’s public key. Upon a request (i.e. A talks to B), B knows the user U and then can ping AUTH to check if U has access to B.

Am I missing something? I’ve always been told never to implement security protocols, so I’m hesitant to adopt this solution. However, I don’t know what would be the best way to handle this.

  • Have you looked at traditional SSO solutions such as SAML? I think they provide exactly what you want. – Neil Smithline May 15 '16 at 23:43
  • Thanks for the suggestion! From my understanding, in the scenario laid out above, services B and C would need to authenticate against AUTH. But since they are backend REST APIs they don't have access to cookies stored in AUTH. Therefore SAML/traditional SSO doesn't seem to work here. Am I misunderstanding something? – sparknoob May 16 '16 at 0:02
  • I think that A could pass the SAML assertion to B which could pass it to C. B and C can validate the assertion to ensure that it is not forged. Possession of a properly signed and valid (eg: not timed out) assertion means that you have authority to act on behalf of that user. I do think it all works and is a standardized implementation of exactly what you are suggesting. – Neil Smithline May 16 '16 at 0:08
  • @sparknoob So what solution did you implement to solve the problem ?? – Manuj Rastogi Nov 25 '16 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.