Same login cross multiple sites with transparent login proces

Question

The issue

Let's say that I have example.com, example.org and example.net.

All of these sites have a login which authenticates against the same base of user credentials.

I'm looking for at efficient way to only log in one place but still having the ability to be transparently logged in at the sites sites.

My current solution
...is having an iframe loading a resource on one of the sites (which I call main site) and if the user is logged in at the main site, refresh the page using a token and automagically log in the user through some JavaScript.

But this is really ineffecient and insecure for several reasons:

User needs to log in at the main site
User needs to refresh his page, using some clientside code (I'm aware that it might not be possible to avoid this).
Using iframes is generally frowned upon and some even have browser plugins blocking these.

What I'm not looking for
I'm not interested in using some third party provider like Facebook, Google or an OpenID provider as this would require my users to register with third party websites to use my services.

Summing up to the specific question
Just like Google and even StackOverflow, the process between the sites authentication seems transparent I need something similar. What is the better option to my current solution?

Also, see this: http://stackoverflow.com/questions/44509/single-sign-on-across-multiple-domains — Benjamin Gruenbaum, Jun 18 '12 at 09:41
@BenjaminGruenbaum It seems that handling your own OpenID provider isn't that simple and besides using JanRains bloated solution, noone seems to have created an up-to-date solution for PHP. — Repox, Jun 18 '12 at 09:45

score 4 · Accepted Answer · answered Jun 18 '12 at 09:56

4

I cannot share code ... but the solution I implemented involved a middle-man to handle the authentication for all my sites... which we called an SSO Broker....

Basically, all login requests go via the SSO Broker, it will determine if you have logged in already in sitea when trying to access siteb.

... The closet I can point you to for how we implemented it is: http://www.jasny.net/articles/simple-single-sign-on-for-php/

The other sso solutions all have their place too, but some are more complex than required.

The other simple approach is, simply passing some (secure-ish) token between each other.

answered Jun 18 '12 at 09:56

Brian

8,418
2
25
32

How would you eliminate the need of user to log in when he moves from exampe.com to example.org? I think user will still need to enter username and password on example.org but that can be validated on common OpenID server – HaBo Apr 15 '15 at 21:33
@HaBo Have you tried the jasny code? It seems to work correctly. – kojow7 Jun 22 '16 at 16:18

Same login cross multiple sites with transparent login proces

The issue

1 Answers1