3

I'm need a solution that allows single sign-on for various websites on different domains for an organisation. I do not need to implement this myself, rather I need a clearer picture what exactly I should be looking for.

I'm actually not quite sure if I'm using the term correctly - the classic definition of SSO seems to be "once logged in you have access to multiple applications". What I'm looking for is something that allows to have a single set of credentials per user for multiple sites and web-based services. This must not rely on external entities, so it must be possible to run an identity provider on the organisations' server.

Before I started doing research I was convinced that I had a basic idea how this works. After reading for a few hours I have to admit I'm baffled. Some articles on the web warn that SSO should not be confused with things like OpenID. However OpenID Connect is hailed in other places as the future of single sign-on applications. It is based on OAuth2 which is allegedly so insecure that one Chief Developer run away screaming, but still seems to have turned into a quasi industry standard. Etc., the more I read the confused I got.

Also I'm not quite sure if different access levels can be handled by the identity provider or if they need to be handled on application level. I need to put users in different groups (they need different permissions inside the Websites - I guess what permission applies to which group must be handled on the application level).

So here is my wishlist:

  • I'm looking for a single sign-on solution for multiple web services
  • no external provider, self-hosted
  • should handle authentication as well as user management (if at all possible)
  • needs at least a PHP client (and possibly Java)
  • Open Source preferred (because of "free as in speech", not "as in beer" - there is a budget)

At this point I would be already happy with some broad hints ("yes, OpenID Connect is the ticket" or something like it).

Improve this question
1
  • Some information that could rule-out or rule-in some solutions. 1) What web server are you using? Or, more to the point, are you using Windows servers? 2) You mentioned different domains: whatever the OS of the web server(s), do the domains have any form of trust relationships? 3) Whatever the OS of any web server(s) or other server(s), do the users of your organization already have some kind of central user authority (or authorities with trust relationships): the most common situation is that everyone in the organization has a Windows account to sign in to their computer.
    – hunterhogan
    Feb 15, 2015 at 21:52

2 Answers 2

Reset to default
1

OpenID

OpenID is a great solution. Here there are some different ideas. The first idea was OpenID 1.0 which is made for auth and only auth. But for some practical reasons, companies have switched to OAuth2 which grant access and they combine both into OpenID Connect or simply using OAuth2 as an auth system. For your reference you can look at what systems are used to connect to cloud APIs: http://passportjs.org/guide/providers/

Improve this answer
1
  • Do you know how user management / user roles are handled with OpenId (i.e. are they handled at all or is OpenId just authentication and the application has to figure out which resources might be accessed by a user) ?
    – Eike Pierstorff
    Feb 16, 2015 at 13:40
0

Have a look at Auth0. In can handle authentication but also has support for authorisation.

PS, I'm not affiliated but my company has just chosen it hence the hint

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.