I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
It is a security concern, because half of transport between end user and end application is unencrypted and will be a subject for MITM. That is, SSL between your app and end app doesn't make much sense, because transport between user and your app is wide open for any kind of manipulations. You really should protect all communication transport with SSL certificate.
If the connection between your server and the user is insecure (because you aren't using TLS), then an attacker can:
- Read all data that the user enters, or enter their own
- Modify data that the user enters before it reaches the server, and/or modify data that comes back from the server before the user sees it
- Hijack the user's session token and browse the site while signed in as the user, even if they don't have the user's credentials
- Replace the link to the secure sign-in page with a link to a spoofed page that looks identical but that allows the attacker to harvest credentials
The victim has a chance to detect the last attack - although, depending on how your site normally directs users to the auth service, it might not be a very good chance - but the other attacks are nearly undetectable at the time they are happening, and if the attacker can hijack the user's session and tamper with their data, who cares if they don't actually have the credentials?