Note: This is a duplicate of a question that I asked on the InfoSec StackExchange. Even with a bounty, this did not receive any satisfactory answer, and it was suggested by one of the commenters that I post here.
We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single single-sign-on system (Shibboleth) provided by our university to handle authentication. Authorization/roles are manually configured per-user at each web service. Our current architecture is shown below:
We would like to extend our system to allow logins using Google, Facebook, LinkedIn and other universities. It seems like we need a middleware that is in charge of authentication and role management. Roles are frequently created and cannot be statically defined. The middleware should also perform session management (like handling timeouts, single log-out). We picture something like the following:
What components would we need in this middleware? Our sysadmin is considering Gluu or Keycloak along with an AD service. Would either of these solutions meet our requirements? Are there any best practices or vulnerability/configuration checklists for such systems?
Do you really mean that Shibboleth normally handles the authentication and you want to allow OAuth authentication instead with a range of providers?-- @JulianKnight: Not quite. For anyone using one of our web services, we want to hand off authentication to a middleware layer. This layer should allow a user to choose whether to be redirected to a Shibboleth-SSO, which our institute uses, or using OAuth from a range of providers. We only redirect, and are never on the traffic route. – Jedi Jun 16 '16 at 23:00