0

Note: This is a duplicate of a question that I asked on the InfoSec StackExchange. Even with a bounty, this did not receive any satisfactory answer, and it was suggested by one of the commenters that I post here.

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single single-sign-on system (Shibboleth) provided by our university to handle authentication. Authorization/roles are manually configured per-user at each web service. Our current architecture is shown below: enter image description here

We would like to extend our system to allow logins using Google, Facebook, LinkedIn and other universities. It seems like we need a middleware that is in charge of authentication and role management. Roles are frequently created and cannot be statically defined. The middleware should also perform session management (like handling timeouts, single log-out). We picture something like the following:

Architecture of proposed system

What components would we need in this middleware? Our sysadmin is considering Gluu or Keycloak along with an AD service. Would either of these solutions meet our requirements? Are there any best practices or vulnerability/configuration checklists for such systems?

4
  • 1
    I'm quite surprised that you didn't get an answer on InfoSec. The picture you describe is very much like what stackexchange uses. – CPerkins Jun 15 '16 at 18:37
  • I missed the wood for the trees. Couldn't find a detailed infrastructure guide for how StackExchange is implemented though. – Jedi Jun 15 '16 at 19:08
  • Your diagram implies that you want your web services to allow logins to Shibboleth, Google, LI, etc? Whilst this could be done, I think that all users would have to trust your middleware to handle passthrough of traffic to their personal services. I'm not sure that is what you mean though. Do you really mean that Shibboleth normally handles the authentication and you want to allow OAuth authentication instead with a range of providers? – Julian Knight Jun 16 '16 at 20:04
  • Do you really mean that Shibboleth normally handles the authentication and you want to allow OAuth authentication instead with a range of providers? -- @JulianKnight: Not quite. For anyone using one of our web services, we want to hand off authentication to a middleware layer. This layer should allow a user to choose whether to be redirected to a Shibboleth-SSO, which our institute uses, or using OAuth from a range of providers. We only redirect, and are never on the traffic route. – Jedi Jun 16 '16 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.