I have following requirements for system:
- My admins authenticate on client servers
- Over http
- Central authorization server
My solution is based on O-Auth:
- user is redirected to authentication server to check his creditals (certificate / password), server saves auth-token in db with timestamp and userId
- server redirects user back to client with auth-token in url
- client connects to server over https passing auth-token, it's secret and id
- server checks if client creditals are ok, and if it has non-expired auth-token in db (auth-token is removed then)
- if so, it takes user claims and pass it back to client server
- client server then uses cookie to auth user
Is it good idea? Maybe something like this is already available (I'm using C# mvc)?
Is passing auth-token through http huge risk?