I work for a web company that's undergoing a massive rewrite in order to separate our Data out into its own RESTful service application - the goal is to be able to sell access to third parties and quickly prototype internal applications without needing direct access to the DB.
We currently have three Applications - The aforementioned Data API, a CMS, and a Front-end. Users need to be able to log in to the CMS to modify Data through the API, and we'd really like to integrate our Google Web Apps into this - logging in Via Google. Ideally, this would use the OAuth flow, because it's the most transparent to our users - but I'm unaware of any way to share the OAuth information between applications without possibly compromising their security.
What I've tried
Concretely? Nothing. My initial proposal was to generate what is essentially "Nested OAuth" - set my Data Application as an OAuth Provider for all other applications, then use the Google OAuth flow as the unspecified Authentication standard within the Data Layer - it's an entirely Restful API, so it would be pretty much transparent to the user, but it seems to violate the concept of OAuth, and I feel like there should be a better way to do it. The flow would look like this:
- User Requests Login for the CMS
- CMS gains an Auth Token from the Data Layer
- CMS Redirects the User to Login page hosted at the Data Layer
- Data Layer Gains an Auth Token from Google
- Data Layer redirects the User to Google Login Page
- Google Authenticates the User, then redirects the User back to the Data Layer with an Auth token
- Data Layer uses Auth Token to get Access Token for Google Services
- Data Layer redirects User back to the CMS with another Auth Token
- Auth Layer uses Auth Token to get an access token for Data Services
But it seems, well, clunky. I'd also like to not have to force the user through mutiple "Allow" pages - one from Google to allow the Data Layer, and One from The Data Layer to allow the CMS (or some later application) to access. What I really need is to use Google for a SSO or Kerberos situation, and have Google give out tickets for my applications. If anyone knows a way to leverage that with Google, I'd gladly trash this whole design.