We're working on an SSO implementation that would be used accross domains. I realize there are proven working models out there like CAS for this but I'm toying with a different approach and I want to get feedback from you all here to see if this is secure or not. The basic premise is that we don't want to use redirects if we don't have to and we want the product sites to be able to style their own login pages. This targets IE8+ and modern FF and webkit only. So, without further ado the implementation:
- Client browses to product site A.com. They don't have a session cookie for a.com so the site initiates the parent auth script.
- The parent script builds an iframe that loads a page from the auth server on auth.com. Auth.com validates the request based on the referer header and if the referer isnt trusted then responds with x-frame-options:DENY and/or a frame busting redirect.
- The script on this page (the framed script) does an ajax request to auth.com's server asking for an SSO 1 time token (1TT).
- The client doesn't have an auth.com cookie so this is rejected, and the iframe script tells the parent script to build an auth form using window.postMessage (and the parent script validates the origin) to communicate since it is cross domain.
- The user enters their credentials, and hits submit.
- The credentials get passed from the parent script to the framed script via postMessage again, and the framed script uses them to login to auth.com, receiving both an auth.com cookie and a 1TT.
- The 1TT is passed back to the parent script.
- The parent script passes the 1TT to A.com's server.
- A.com uses the 1TT to get the user info from auth.com's server via a private internal API, and auth.com invalidates the 1TT so it can't be used again.
A.com returns a session cookie for A.com to the client, and now the client goes about its business on A.com.
Then the client browses to B.com, but again has no session cookie for B.com. The parent script is executed again, which creates an iframe again pointing to auth.com. The iframe script requests a 1TT from auth.com, and since it has a session cookie for auth.com this time it gets one.
- The 1TT is passed from the iframe script to the parent script to B.com's server which uses it to get the user from auth.com and issue a session cookie for B.com.
My main concern is at step 2. Is this a solid way to prevent malicious framing? What other security vulnerabilities is this susceptible to?
Edit: All sites and scripts will be loaded HTTPS.
referer
header logs you into a site you would otherwise have access to; not sure if it's that big a deal (esp. since I assume you issue tokens per-site)