Integrating SSO across differents Domains using WebService?

Question

i have 3 différents domains domain-a.com and domain-b.com also domaine-c.com and i want to use SSO, if you log in to one of these domains you have access to all other domains.

1 - using cookies is impossible because we can't share the same cookie with differents domains

2 - i'm thinking about using webservice, but i'm not good in that so i'm wondering if it's a good solution

If you have any suggestion or recommandation or any thing Please i need you.

Here's a possible solution: http://stackoverflow.com/a/45010/3079918 — magnetronnie, Mar 03 '14 at 16:19
see this:http://www.jasny.net/articles/simple-single-sign-on-for-php/ — Jason OOO, Mar 03 '14 at 16:21

score 0 · Answer 1 · answered Mar 03 '14 at 16:20

You can't share cookies but you don't need to.

Let's say your SSO runs on sso.domain.com

You want to log in on a.domain.com:

Make an XMLHTTPRequest request to sso.domain.com to check if you have a session.
If you have a session and are logged in you get a login token back.
You pass the token to application A with an XMLHTTPRequest. It sends a request to sso.domain.com to verify the token and get the user credentials.
You are now logged in on a.domain.com

This setup requires Cross-Site-Resource-Sharing to be enabled on the sso domain. The CORS implementation allows you to do the login process under water, no redirect is required.

Your an indepth look at CORS see: http://fritsvancampen.wordpress.com/2013/02/03/cross-site-origin-requests-aka-cross-origin-resource-sharing/

score 0 · Answer 2 · answered Mar 03 '14 at 16:41

I use SimpleSAMLPHP.. (https://simplesamlphp.org/)

This allows me to make a single place I can ask if users a logged in. The whole thing uses SAML2 which is a secure markup language(http://en.wikipedia.org/wiki/SAML_2.0).

It can be a steep learning curve to make it work but its very safe and everything is encrypted using certificates. The nice thing is that you can use all the IDP's(identity providers) you can think of. This means you can implement facebook, google etc. log-in's as well as custom log-in's.

Another great thing is that it provides SLO(single logout) as well. This will trigger log-out's in all the applications that are currently logged on..

Integrating SSO across differents Domains using WebService?

2 Answers2