61

We offer a number of online services. We are required to develop a system which provides a quick/simple experience for users if they are transferred from one service (on domain1.com) to another service (on domain2.com).

Is there a safe and secure way to log a user in automatically once he has been transferred to the new service?

Yell at me if the solution below is completely insecure/wrong.

We were considering a system similar to that provided by a number of online services for password recovery - they are emailed a link with a unique hash which expires, that allows them to change their password.

The domain1.com site would generate a unique hash and store it in a database with the hash linked to a user along with an expire datetime field.

The user will be transferred to domain2.com/auto/?hash=d41d8cd98f00b204e9800998ecf8427e

domain2.com would next make a request to domain1.com with the hash to get the information about the user. domain1.com would then remove the hash from the database. domain2.com would log the user in and set cookies, etc.

Could something based on OpenID or OAuth achieve the same results?

5 Answers 5

147

Single sign-on (SSO) is conceptually pretty simple.

  • User hits domain1.com.
  • domain1.com sees there's no session cookie.
  • domain1.com redirects to sso.com
  • sso.com presents login page, and take credentials
  • sso.com sets session cookie for the user
  • sso.com then redirects back to domain1 to a special url (like domain1.com/ssologin)
  • the ssologin URL contains a parameter that is basically "signed" by the sso.com. It could be as simple as a base64 of encrypting the loginid using a shared secret key.
  • domain1.com takes the encrypted token, decrypts it, uses the new login id to log in the user.
  • domain1 sets the session cookie for the user.

Now, the next case.

  • User hits domain2.com, which follows domain1 and redirects to sso.com
  • sso.com already has a cookie for the user, so does not present the login page
  • sso.com redirects back to domain2.com with the encrypted information
  • domain2.com logs in the user.

That's the fundamentals of how this works. You can make it more robust, more feature rich (for example, this is SSOn, but not SSOff, user can "log out" of domain1, but still be logged in to domain2). You can use public keys for signing credentials, you can have requests to transfer more information (like authorization rights, etc) from the SSO server. You can have more intimate integration, such as the domains routinely checking that the user still has rights from the SSO server.

But the cookie handshake via the browser using redirects is the key foundation upon which all of these SSO solutions are based.

7
  • I like this method... of course, it relies on yet another domain to do the job. Which adds further complexity. I can't however come up with a better solution myself +1 Dec 5, 2008 at 1:36
  • Well, same domain SSO is easier because you don't have to do the redirect cookie shenanigans. But this will work in either case. Dec 5, 2008 at 3:45
  • 4
    careful with the ssologin url with the "signed" parameter.. if your parameter doesn't contain a nonce/timestamp someone capturing that querystring will be able to use it to login. putting everything over SSL would mitigate this.
    – russau
    Dec 15, 2010 at 5:51
  • @russau I am going to implement this method, but I am having some difficult in setting nonce, where should I store it?
    – albanx
    Dec 2, 2014 at 12:35
  • @albanx The nonces is part of the request. You use the nonce to gate the validity of the request. For example, the nonce is set to the current time GMT, and when the server gets it, it can compare the nonce time to the current time. If it's more than, say, 1 minute old, it can deny the request. But simply add the nonce to the request, in plain text. Dec 2, 2014 at 17:29
8

If someone were able to play man in the middle and grab that hash, would they be able to steal the cross domain transfer? Obviously it needs to be generated and sent to the client prior to them needing to use it. So say for instance:

I'm playing man in the middle spying on Jack. Jack accesses domain1.com which causes a hash to be prepared and sent to him so that when he accesses domain2.com he can send that hash as authentication. As he accesses domain1.com, his request comes through me, you return the page, I grab the hash and let him carry on. I access domain2.com using the hash, you've now let me into domain2.com and deleted the hash. He's none the wiser until he attempts to login to domain2.com and is told that his credentials are no longer valid.

How do you overcome that?

2
  • 7
    With SSL. You can't play man-in-the-middle if Jack authenticates the domain1.com server and has a confidential channel.
    – erickson
    Dec 4, 2008 at 23:41
  • good point. That theoretically should mean that the OPs model should be reasonably secure as it stands assuming they're using SSL then. Dec 5, 2008 at 1:34
7

There wouldn't be any point using SSL for the cross-domain login unless you use SSL for the entire session. It is just as easy to steal a session cookie as it is to use a hash in an url. What is the point in hiding the hash in SSL if the rest of the session is insecure.

The method given at the top is pretty much the standard method. Whether you choose to use secure protocols is another matter entirely, but it would be pointless to only encrypt part of the session.

6

This is a good solution. Here are two points to consider:

You use the term "hash", but it's not clear what data you'll hash. Instead, use a "nonce": a large (128-bit) number generated by a cryptographic quality RNG.

Also, you didn't specify this, but communications between the user and both domains, and between the domains themselves, must be secure. Use SSL to authenticate the servers and to keep the nonce confidential.

2

What about SEO? It looks like every request before succesfull login is redirected to other domain and back. I would tell that this is very ugly. What headers should you send? 301 to SSO and then back 301 to original page? So search bot is "requested" to change his index for that page twice?

1
  • The redirect to SSO should be the end of it - if you don't login you don't get redirected back.
    – Skip Head
    Sep 17, 2010 at 18:21

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.