Quantcast
Channel: Bountied questions - Information Security Stack Exchange
Viewing all articles
Browse latest Browse all 154

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

$
0
0

I need to implement an SSO solution with the following requirements:

  1. Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I visit b.com.
  2. Centralized: Unlogged user clicking "Login" on a.com is shown a login screen hosted on sso.com. Credentials are checked by sso.com in data source only accessible to it.
  3. Auto-login: If the user has logged in to a.com, and subsequently visits b.com, they will be immediately logged in. I.e., on b.com, instead of a "Login" link, we want to display right away their username, etc - without the need to click anything.
  4. No redirect for anonymous users: Vast majority of my users will use the sites without having an account. Therefore, when they first come to a.com, or b.com, there must not be a quick redirect of the entire page to sso.com and back to check if they are logged in. Such a redirect would be bad for SEO and latency.

For the few users who have logged in to a.com and then go to b.com (or vice-versa), a redirect is acceptable.

There's a lot of examples on the web for SSO, especially with OAuth2, OpenID Connect, and CAS, but I could not find a recipe for these specific requirements. The closest is the Stackoverflow SSO guide (here), but they have some extra requirements I don't have (e.g. login should still work if SSO server is down).


Viewing all articles
Browse latest Browse all 154

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>