1

I need to implement a Single Sign On process for a site. I'll refer to Site A as the site with the Sign on screen and site B as the site that needs to Auto sign on. The two sites are on different domains and I do not have any control over site A. But I need to suggest ideas for the process.

After some reading I have this suggestion. Site A passes a ticket in the query string to site b. Something like SiteB.aspx?Ticket={guid}. This ticket must be a one time valid value that will be managed by Site A. My site (Site B) will pass the Ticket back to site A in the form of a web service call. The response from this call if the ticket is valid will contain an account ID that I can use to auto log in.

Does this seem an acceptable solution? Site B will be under HTTPS. Would passing the Ticket in the query string be secure or would the Ticket be best passed as an additional header? Would the ticket still need to be encrypted if under https?

1 Answer 1

2

No, this does not seem like an acceptable solution to me, for a couple of reasons:

  • The query string is not encrypted, even when using HTTPS
  • Someone looking over the shoulder of a user could hijack that user's session
  • You haven't specified a maximum lifetime of a ticket, which is important should the ticket be compromised (Kerberos tickets all use this functionality)
  • You haven't established how Site B trusts Site A. Sounds like someone could step in the middle and perhaps fool Site B into thinking it's Site A and Site B would authenticate them.

You could get both sites to share the same key so that they will honor each other's Forms Authentication cookie.

2
  • If I sent the Ticket in a header would this be encrypted by https and thus resolve any query string issues? Site B would call a web service to validate the ticket rather than back to the site that called site B. So I think that would resolve any problems of someone stepping in the middle? Ticket management must be provided by site A. ie. A one time token and only valid for 30 secs etc...
    – fizzer
    Aug 15, 2010 at 13:55
  • That would resolve the issue with the query string not being encrypted, but you need a mechanism for Site B to KNOW that Site A is who it says it is, otherwise you are still vulnerable to a MiM attack. This is typically done with certificate based authentication, or by using a shared secret between Site A and Site B. Aug 15, 2010 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.