4

I'm currently trying to join 2 web apps on different domains example1.com and ex.example2.net so that you can login to example1 and click on a link to example2 and be instantly signed in, as it would be more convenient for customers to just login the once and navigate between the sites.

I've researched various means ie. php sessions, openID, JOSSO and Kerberos, but what would be a secure and easy way to implement this?

Binar Web
  • 867
  • 1
  • 11
  • 26
Josh Naylor
  • 253
  • 1
  • 5
  • 12

4 Answers4

2

Kerbros is very extensive and for systems requiring high security. Its very difficult to work with, and even just setup over all, I would not suggest this route unless you know linux very well, and provided your hosting provider allows you that type of access over the machine.

Im not familiar enough with JOSSO or openID to comment well on those however.

Any php sessions are only good for the domain, and server the domain is on, kind of like cookies but not, though in all you would use them.

I think your easiest solution more so if the 2 sites are on the same hosting account/server. Is to have a database specific to this cause. What you would do is create a login system like you would normally but instead you would have 2 sites reading off this login. Aside from the normal login you would also have a session tracking table. Typically you already set sessions when users login to keep them logged in, and you'd do the same here, but you'd add a cookie into the equation one both sites can recognize and use to compare entries in this new table where your tracking your users. I'd say keep try by IP, Browser, and maybe a userID all in one cookie with a unique hash of some kind as well thats specific to the user based on something only the servers could recreate on the info they have for the user.

Of course I dumb it down in conceptual speak, its a little more elaborate than I make it out to be, but this would be your general stepping stones.

Also if the sites are independent of one another you could always create an API between them to pass info back and forth JSONP style so one can act as the hub for the login while the other just validates

But in all its all dependent of what your wanting to do overall how, when where, etc..

chris
  • 36,115
  • 52
  • 143
  • 252
  • would this still work if the domains are on different servers? – Josh Naylor Jul 30 '12 at 15:46
  • It can, but you have to decide which one will be the hub of the interactions, as that one you will also need to program an api that interacts with the DB on behalf of the other server. The other server would make calls to this API and the API would give whatever needed back, as I said its a little more elaborate that I made it out to be in my answer but its possible none the less. SSO is not easy to impliment, but the payoff is awesome if you have more than one site you need it for. – chris Jul 30 '12 at 16:36
  • yer at the moment it will be just two web apps. But the example1.com will kind of be the central hub when we expand and have multiple web apps associated with it, – Josh Naylor Jul 30 '12 at 18:11
  • then yea, your going to want to overall build an API like service on the hub, that has all the core logic of sharing the credentials and validating them across the sites/servers, which either outputs or send back data to the server that sent the request. I'm intent on trying to build a SSO option myself sooner or later, Ive 50+ sites I wanna get built up, where I want one core login and user base. So I feel your pain, it's worth it in the end, – chris Jul 30 '12 at 18:17
1

If it works for you, my suggestion would be to go the openID route. It's the easier way and it's secure enough. Besides, the registration process is easier and quicker to users too.

You can actually only allow IDs from your sign-in domains, if you prefer, making it pretty much a "private" login system.

There are downsides too... You don't have fine control over the registration process, you are dependent of openID authorization process... There are some problems that might happen if your host is not well configured (timezone differences, for instance).

But overall, it's a relatively secure system, easy to implement.

Kerberus is extremely secure but it's a nightmare to work with. Unless you're dealing with highly sensitive user information, like credit card numbers, or think your websites make apetizing targets for hacking I don't think it's worth your time.

Tivie
  • 18,864
  • 5
  • 58
  • 77
  • What kind of registration do customers have to go through. Its logistics tracking so it will have customer details but not bank details. Will it be secure enough for that? – Josh Naylor Jul 30 '12 at 15:41
  • Well, yes. Paypal, Google, Yahoo, etc... use openID (Edit: are identity providers), so I reckon its secure enough, although they probably have their own custom implementation. – Tivie Jul 30 '12 at 15:56
1

You can have one application handle logins for both sites using php sessions.

example1.com user logs in and php session cookie is stored.

ex.example2.net check example1.com and validate session cookie. if it does not exist redirect to example1.com login page or a custom login page on example1.com. If it does exist, then log the user into ex.example2.net.

If you only want a link then you generate a hash and pass that to the second app once they have logged onto the first. If the hash validates, then log them in.

jarchuleta
  • 1,231
  • 8
  • 10
0

I would use a database table that is shared between the two sites. If you go down the PHP session route don't try and just pass the session data from one site to the next on separate domains, it won't work. I found this post helpful many moons ago: Single Sign On across multiple domains

Community
  • 1
  • 1
Richard Askew
  • 1,217
  • 1
  • 10
  • 16
  • Yer that was a big help too me too, I only thought I'd ask again as it was posted 4 years ago. Alot of things change in that time. So i want to be creating say example3.com with a login_script.php which the other 2 get re-directed to and either creates a session when authenticated or finds the one already associated with that user. – Josh Naylor Jul 30 '12 at 15:24
  • It's still the simplest solution and easy to understand and follow through. If you just need the two sites, pick one to use as your 'master' domain, you shouldn't need to create a third domain. – Richard Askew Jul 30 '12 at 15:25
  • What if one site is behind a firewall. Will this still work? – Sablefoste Jul 30 '12 at 15:34
  • Yes it should do because you are interrogating the database each time, as long as the route to the database server is allowed – Richard Askew Jul 30 '12 at 15:36