I am working on implementing an authentication server which will provide single-sign-on for the web applications our company produces and am working with DotNetOpenAuth2 at the moment. My problem is that DNOA works like this (from the Apress book Pro ASP.NET Web API Security by Badrinarayanan Lakshmiraghavan)
But I want it to work like so (this image I edited):
Is there a way to make it do this, or another framework I should use instead? I want to do this to make the security simpler and more comprehendable to later developers. Following is an explanation of why this would be a good fit for my purposes.
All of our web apps support HTTPS and are under 1 of 2 parent domains (so each web server has 2 x509 certificates that support SSL on subdomains like *.domain1.com or *.domain2.com).
My plan is to use the existing certificates as an implicitly shared secret to encrypt tokens minted by DotNetOpenAuth2. So when creating tokens the AuthorizationServerAccessToken.ResourceServerEncryptionKey would be the public key of the SSL cert and the AuthorizationServerAccessToken.AccessTokenSigningKey would be the private key of the SSL cert.
This way any of my servers has the ability to decrypt a user token and extract authorization claims from it in a secure way. Given the simplicity of the scheme I just want a single auth endpoint that receives a username and password and returns an encrypted token.
It seems this simplification makes things both more secure and easier to implement. Especially since we can do away with the nonce. One possible weakness is that an attacker that gains access to a web cert private key will also be able to spoof user auth tokens. But it seems that assuming your SSL certs haven't been compromised is ok security practice, given that the security of web applications usually rests entirely on that assumption. And I'm not storing sensitive information in the tokens anyways, just permission flags.