I'm need a solution that allows single sign-on for various websites on different domains for an organisation. I do not need to implement this myself, rather I need a clearer picture what exactly I should be looking for.
I'm actually not quite sure if I'm using the term correctly - the classic definition of SSO seems to be "once logged in you have access to multiple applications". What I'm looking for is something that allows to have a single set of credentials per user for multiple sites and web-based services. This must not rely on external entities, so it must be possible to run an identity provider on the organisations' server.
Before I started doing research I was convinced that I had a basic idea how this works. After reading for a few hours I have to admit I'm baffled. Some articles on the web warn that SSO should not be confused with things like OpenID. However OpenID Connect is hailed in other places as the future of single sign-on applications. It is based on OAuth2 which is allegedly so insecure that one Chief Developer run away screaming, but still seems to have turned into a quasi industry standard. Etc., the more I read the confused I got.
Also I'm not quite sure if different access levels can be handled by the identity provider or if they need to be handled on application level. I need to put users in different groups (they need different permissions inside the Websites - I guess what permission applies to which group must be handled on the application level).
So here is my wishlist:
- I'm looking for a single sign-on solution for multiple web services
- no external provider, self-hosted
- should handle authentication as well as user management (if at all possible)
- needs at least a PHP client (and possibly Java)
- Open Source preferred (because of "free as in speech", not "as in beer" - there is a budget)
At this point I would be already happy with some broad hints ("yes, OpenID Connect is the ticket" or something like it).