Single sign-on solution which can authenticate using an existing database

Question

I am searching for a SSO-engine/scheme that can work with an existing self-made SSO solution, in order to eventually replace it.

Since the migration will not be done in one step, it must be compatible (or being able to be made compatible) with the current solution in maintainable way (plugin or something). This would be possible if the new solution could authenticate users using a webservice built using the old solution.

Other things I want:

• There should exist a client library for PHP.
• It should be reliable and proven, not the newest stuff.
• It would be nice if the SSO-Provider would be implemented in PHP (but this is no exclusion criterion).

Of course, I have searched a bit myself, and found two possible solutions:

1. OpenID - question here is: Which server is good and maintained?
2. LDAP - Heard it is a pain to set up.

I have no experience with either one, so I cannot really make an informed choice myself.

Answer 1

I have now settled for OpenID, using the simpleid OpenID-Provider. It is easily extendable, and the code seems sane - it's written in an imperative programming style.

It can be easily extended with own extensions, and the complete storage layer can be replaced by writing a (somewhat) small module.

As client library I'll use LightOpenID, since it does nothing too fancy (e.g. no self-implemented Diffie-Hellman key-exchanges).