I need to implement an SSO solution with the following requirements:
- Cross-domain: Let's assume I have
sso.com. If I become logged in through
a.com, I shouldn't need to login when I visit
- Centralized: Unlogged user clicking "Login" on
a.comis shown a login screen hosted on
sso.com. Credentials are checked by
sso.comin data source only accessible to it.
- Auto-login: If the user has logged in to
a.com, and subsequently visits
b.com, they will be immediately logged in. I.e., on
b.com, instead of a "Login" link, we want to display right away their username, etc - without the need to click anything.
- No redirect for anonymous users: Vast majority of my users will use the sites without having an account. Therefore, when they first come to
b.com, there must not be a quick redirect of the entire page to
sso.comand back to check if they are logged in. Such a redirect would be bad for SEO and latency.
For the few users who have logged in to
a.com and then go to
b.com (or vice-versa), a redirect is acceptable.
There's a lot of examples on the web for SSO, especially with OAuth2, OpenID Connect, and CAS, but I could not find a recipe for these specific requirements. The closest is the Stackoverflow SSO guide (here), but they have some extra requirements I don't have (e.g. login should still work if SSO server is down).