security - SSO for two applications that use different identity providers -


i want perform sso between 2 web apps. here scenario:

apps & b (both provide restful api). app b uses form based authentication , can not make modifications app b. also, app , app b maintains different user stores authentication.

user registers in app , after registering, logs in app , calls api app b require user authentication.

the goal ensure once user logs app should able call authenticated api of app b without need logging in app b again.

i went through cloud based sso solutions provided pingidentity, stormpath , few other vendors , looks sso across multiple applications require either applications should trust same identity provider or apps should understand saml/open id. also, require me change way app b handles authentication (but can not make changes app b.

i have thought of simple solution scenario (which in way sso approach http://www.opengroup.org/security/sso/sso_intro.htm)

once user logs in app a, server make background login call app b (using pre-configured default credentials app b). in response login, app b issue session cookie passed in subsequent api calls app b. approach has drawbacks of using default credentials app b it's simple , work.

however, before going path, wanted know if scenario can handled in different way using standard sso solutions ?

traditionally, there "glue" binds sso applications together. there needs inherent trust between 2 applications. commonly done protocols (saml / open idc) or shared secrets (for validating signatures).

in scenario describing, have no control or access how app b authenticates, need authenticate "in background" app b , hold on session cookie subsequent requests.

however, inherently insecure. it's creating anonymous login app b using users of app a. far app b concerned, same user logging in.

if had ability create account in app b such each account in app had analogous account in app b logged in to, more secure.

hope helps!

full disclosure: work stormpath.


Comments

Post a Comment

Popular posts from this blog

php - Wordpress website dashboard page or post editor content is not showing but front end data is showing properly -

Image
recently have uploaded wordpress site onto server. have uploaded wordpress site in sub-folder under root folder ../root(domain root folder)/wordpress (where host wordpress folder). now problem content data in page or post in dashboard of wordpress admin panel not showing - see image. but data showing in front view - see image. if not browser cache issue , not issue happened tinymce editor during upgrade; try add config file: define('concatenate_scripts', false);
Read more

How to get the ip address of VM and use it to configure SSH connection dynamically in Ansible -

i trying ip address of vm , trying use establish ssh vm. following script: --- - hosts: localhost become: yes connection: local gather_facts: false serial: 1 vars_files: - createvmvars.yml tasks: - name: gathering vm info. vsphere_guest: vcenter_hostname: "{{vcenter_hostname}}" username: "{{vcenter_username}}" password: "{{vcenter_password}}" guest: "{{guest_name}}" vmware_guest_facts: yes register: var - debug: msg="{{var.ansible_facts.hw_eth0.ipaddresses[0]}}" - name: establishing ssh connection. script: /home/shasha/devops/scripts/ssh_configure.sh "{{var.ansible_facts.hw_eth0.ipaddresses[0]}}" following content of ssh_configure.sh : #!/bin/sh ssh-keygen -t rsa ssh-copy-id $1 but when running playbook, getting following error while executing third task: error! 'var' undefined but debug module(second task) printin
Read more

javascript - Get parameter of GET request -

i make request: createxhrrequest( "get", fileurl, function( err, response ) { if( err ) { alert( "error get!" ); } alert(response); }); and full response: { "status" : "ok", "message" : "jvberi0xljqkjdduxdgkmy how can jvberi0xlj ? i try response.message , response["message"]. nothing works. just simple access this: var json = json.parse(response); json.message
Read more