Simplest federated authentication protocol: is this the right way to do it?

Question

I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more complex than just authenticating a simple server. I've come up with a rough idea of how it could work but I don't know if I've got it right.

For example, user [email protected] wants to log in to server z.com. Let A denote the client computer and a.com A's "homeserver".

Initially, A logs in to a.com using a username and password. When A wants to log in to z.com, it sends a message like "hello I'm [email protected]". Server z.com then contacts a.com, asking for a token (some unique unguessable bytes) which a.com also sends to A. Then A sends the token it was sent to z.com also, and z.com checks that the tokens match. This way, z.com knows that A is authenticated with a.com without needing to know the password.

What are the problems with this approach? How can I learn more about how federation is done in practice?

Answer 1

This is what the original OpenID wanted to do.

And it’s basically how Kerberos works with its tickets.

Problem 1: identification, how does z.com verify [email protected] is actually A, and not A’ pretending to be A? Or A@a’.com pretending to be [email protected].

Problem 2: authorization, all you get is a claim (or stake) that the user is [email protected] but we have no way of knowing if A has any authorization for z.com at all. Or even what authorizations A has on a.com

Problem 3: integrity, your scheme has no mechanism to protect the exchange from getting tempered with. What prevents someone from adding claims to their loving they should not have?

Study suggestion: I would read up on OpenID Connect, and its authorization protocol oAuth 2. OIDC has the concept of “Relay Partner” where a service like z.com could relay its authentication to a.com.

As for federation, I suggest reading up on how the fediverse works and how protocols like Matrix are designed.