I would like to create a SSO where my users can login to machines and wordpress (php) websites.

So far I have LDAP with Kerberos working. I can login with the same credentials to every service, however I can't seem to avoid having to re-login when I move from one service or host to the next.

It's hard to wrap my head around authentication and credentials.

closed as off-topic by Xiong Chiamiov, Serge Ballesta, S.L. Barth, Steve, Xander Jan 9 '17 at 18:31

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    This is pretty vague, and possibly off-topic. What are the specific things you are trying to authenticate? Do you mean by "machines" ssh connections? – grochmal Jan 7 '17 at 1:29
  • Specifically I would like to give my wordpress users access to ssh and other web hosting apps like plesk without having to re-login. I've been researching for weeks now and I can't seem to find a secure way to pass the login information. Does that make sense? – Peter Jaffray Jan 7 '17 at 20:21

I think that you are mixing together authentication and authorization. Being confused by both is very common, so let's first go through what SSO means in these terms.

The purpose of SSO is to authenticate once and then have the correct credentials to authorize yourself into several places. This may be a single credential or several credentials.

If we use a holiday as an analogy we could say that if you purchase: a hotel room, a car and pass to the museum you may do something like a real-life SSO. If you arrive at the hotel and the attendant, after checking your passport, gives you: your room key, your car key and your ticket to the museum; then you authorized once (to the attendant) and got three credentials that will authorize you in three different places.

Note that the attendant could as well give you a single key that would work for all three places: the room, the car, and serve as pass to the museum. In that case you would have a single credential but it authorizes you into different places.

Finally note the tricks above: The hotel staff need to be aware of the fact that you rented the car and that you purchased the ticket to the museum. Moreover, the car must support the same key type as the museum, and the museum must have an agreement with the hotel about the passes.

In WP and ssh (and other apps) things work the same way. The application must be aware and configured to authorize through the credentials that a user received from authenticating through another app.

  • If you are using kerberos to give a ticket to a user which will make for the credntial, you can setup samba (kerberos methos = in smb.conf) and configure sshd (krb5_auth = yes).

  • If you want to use Shibbloleth you will need all apps that will be possible to login to with the credentials to support SAML. As far as I'm aware sshd does not.

For other apps you need to check their configuration to what kind of an authentication they support. Kerberos support is widespread, you will find ways of hooking into it almost everywhere (they may not be trivial though).

You need to perform the credential juggling. For example, if your users have a browser add-on written by you on their machines you may be able to give them a kerberos ticket for the ssh client from WP. If you have no control over their computers that is not possible (if a browser would allow to change the state of the ssh client, or vice-versa, that would be a problem).

But several apps simply do not support SSO and that's it. If a specific museum in the city you want to make your holiday consider itself hipster and indie, and will not accept agreements with hotel chains, there's nothing you can do to get the pass to that museum at the hotel desk.

  • I really appreciate you putting the time into helping me. I am starting to understand what you mean by authentication and authorization. So Kerberos is the hotel staff, LDAP is the directory of Credentials, and WordPress is the hotel key, Plesk Control panel is the car, and SSH is the ticket to the museum. However, "at the museum, you will need to re-login." That is because you can't jump from browser to ssh terminal unless the terminal is in the browser. .. Would you re-word that or does it sound right? – Peter Jaffray Jan 9 '17 at 15:38
  • @Peter - Well, close. Credentials are really the same things that are called credentials in programming. i.e. Kerberos as hotel staff is a pretty good analogy, but the credentials are the WP cookies, and SSH pub-priv keys (or krb5 tickets). So I'd say that WP is the hotel room and SSH the museum itself. There are several things remaining to juggle as the room key (cookies) or SSH key (museum ticket). I'm confident that you can link kerberos to SSH ('cause I did that in the past). Plesk Control is another story, it may not be configurable. – grochmal Jan 9 '17 at 20:53
  • Ok awesome. I will keep it up and again thank you for your time. :) – Peter Jaffray Jan 10 '17 at 5:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.