3

I was just asked to allow a partners users to authenticate to our backoffice just by clicking a link in their backoffice. The only common data we have is these users mail.

I fail to see how I can securely implement this. Any insights?


It seems OAuth2 is the way to go. After a bit reading I suppose the flow must be like

  1. give partner's backoffice an access token through client credentials grant
  2. make them use this token by calling an endpoint which will return a link given the user's mail as parameter

The link will contain a usage-unique token which will be used to authenticate the user.

Given all calls use HTTPS I think this would be secure?

  • 2
    I'm not sure if I understood that correctly but for me it seems like one of these cases where you verify your email for an account by clicking on a link. You could generate a link with a private hash and send that via mail to the user. By clicking on that link the user authenticates himself. But thats definitely not the most secure way! – Lexu Feb 17 '17 at 11:39
  • @Lexu nope they want a link in their backoffice a user could click to access our backoffice being logged. – MatTheCat Feb 17 '17 at 12:20
1

You could implement something like OAuth 2.0 (example). Basically, you have an application, authentication server, and resource server. The application wants to access your resource through an authentication/authorization server. A series of token exchanges in a particular way makes this possible to do securely.

| improve this answer | |
  • I edited my question after reading the article you linked. Is that what you had in mind? – MatTheCat Feb 20 '17 at 8:37
0

I would be very careful with this. Probably the first question is: Where do they want to create the link?

Will it be a static link for each user? - BAD IDEA

Or will there be a button on their portal with a back-end logic (connected to your back-end) that will create a limited one-time link with very short expiration (seconds) and automatically redirect? - THIS COULD WORK.


EDIT:

Yes, OAuth is a solution. I would use something like this:

  1. You will provide a secret key for PBO.
  2. Let's say PBO uses website partner-backoffice.org, there is a button "Go to YBO".
  3. User clicks to the button and goes to partner-backoffice.org/ybo-oauth (still PBO site)
  4. The script /ybo-oauth makes cURL request to YBO (your-backoffice.org/oauth-endpoint) - and sends user's email and other relevant data including secret key
  5. YBO validates secret key and other data (would be great to add PBO IP addresses to whitelist) and returns access token with very short expiration (seconds)
  6. The script /ybo-oauth redirects the user to your website your-backoffice.org/?access_token=...
  7. YBO validates acccess token (and checks expiration) and starts user session (or whatever you generally use)

This should work. If you will use HTTPS and IP whitelist, it could be enough for your purposes.

Abbrs:

  • PBO - partner's backoffice
  • YBO - your backoffice
| improve this answer | |
  • I guess they want a link to be permanently visible in their backoffice. I thought of your second suggestion but I don't know what is needed to do that securely. – MatTheCat Feb 17 '17 at 12:23
  • @MatTheCat Hmm, I don't think it's possible to do it securely in that case! MAYBE with using VPN and IP protection but still I cannot recommend it. My second suggestion covers something like OAuth authentication. But it's a lot of work on both sides. – Zdeněk Feb 17 '17 at 16:55
  • I edited my question; what do you think? – MatTheCat Feb 20 '17 at 8:38
  • @MatTheCat Check out my edited answer – Zdeněk Feb 20 '17 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.