Shared sign-on across web applications

Posted by Graham Stratton Fri, 25 May 2007 16:35:00 GMT

I’ve spent the day on what I can only assume is a really common problem with a distinct lack of a solution.

We have a number of web applications, some Zope-based and also a Pylons app served using the Paste server. We are using Apache as a proxy in front of all of them.

We’d like users to be able to sign in to any of those applications and then access any of the others. To implement their security the applications will need to know what groups the user is a member of.

To complicate matters slightly, users need to be authenticated by NLTM if possible, failing that looked up in an LDAP directory, and if that fails verified against a relational database. For NTML users we’ll need to get the groups out at some point, presumably from LDAP.

Each of the applications will have its own way of keeping track of whether the user is logged in, probably by means of a cookie.

I think there are a few potential ways of sharing the sign-on information, given the restrictions of HTTP:

1) Something similar to OpenID, maybe actually using the OpenID protocol. Write a server which the web applications redirect to if authorization fails for some request. There are OpenID interfaces for plone and AuthKit. But there is a question as to whether the OpenID spec would allow returning of the list of groups a user belongs to.

2) Have the proxying Apache authenticate users and put this information in the environment. This would work if we only wanted to protect whole directories. An Apache module to help with this is mod_auth_tkt, which does rather more. Unfortunately it still doesn’t allow you to redirect users when authorization is required. What is needed is some way of catching a 401, as is done by AuthKit, and providing a sign-on there.

What I think mod_auth_tkt does is to hash the username with a secret code and store it in a cookie. The secret code is share between all the applications. If the browser sends a request claiming to be fred and hashing ‘fred’ with the secret code produces the code passed by the browser, the app1 can conclude that app2 successfully authenticated fred and gave him the code. This is really quite neat and I wouldn’t have thought of it.

3) Use paste.proxy as an extra proxy layer. This makes it easy to add middleware which will intercept status 401 messages and replace them with a login form. Since the proxy would not have a session, it would have to use set cookies in the same way as mod_auth_tkt to communicate user verification.

The problem is further complicated by external and internal Apache instances. The internal one proxies services mainly used internally, and only accepts requests which come either from machines internally of from the external Apache instance. The external one proxies the organisational website, and also allows external access to the internal services.

113 comments

Comments

Leave a response

  1. Qiang said 68 days later:

    your comment on mod_auth_tkt ‘Unfortunately it still doesn’t allow you to redirect users when authorization is required.’ is wrong.

    you can specify a mod_auth_tkt directive in apache conf file like the following:

    TKTAuthLoginURL http://www.example.com/login

    which will redirect user to login if the url is protected.

  2. Oyun said 891 days later:

    nice good article.

  3. proxy sites said 914 days later:

    Going to play with it, right away. Will post updates. Cool bit.

  4. los angeles dui defense attorney said 1016 days later:

    Its very informative…. you shown nice tips which will help us in future… thanks for this article..

    Keep it Up

  5. replica watches said 1022 days later:

    thanks for the share

  6. SEO Company India said 1033 days later:

    Very good post…. In recent days we need some application which works faster….. I welcomes this blog….

    Thanks for sharing

  7. auto insurance quote said 1051 days later:

    We ourselves went through several websites to find knowledge with regard to this.

  8. chatroulette application said 1057 days later:

    It is an outstanding solution and clearly written post. I managed to understand it right away!

  9. Engagement Rings said 1062 days later:

    This post is really well written as it has provided all detailed facts and information about the topic. This post speaks credibility and authenticity and exposes real caliber of the writer. Fantastic job! http://www.whitefleur.co.uk

  10. Kids Games said 1065 days later:

    This blog post is very informative especially on computer programmer or anything that involves the backbone on the internet. I suggest that in every acronym word, there must be a definition of it beside the word so that a newbie will know about it. A great job on sharing knowledge here on your blog. Keep it up!

  11. Ben10 games said 1067 days later:

    I have a similar configuration and similar problems, I wonder how you solve those issues.

  12. girl games said 1067 days later:

    Well, I guess he solved those issues 1067 days later… :-)

  13. Tiffany silver jewelry said 1070 days later:

    That sound s good.I will try.And I am trying to search Tiffany Jewelry online store

  14. Vinyl Banner Printing said 1080 days later:

    its very good post i like it very much, and now subscribed your post.

  15. sports betting said 1083 days later:

    It’s a good post.

  16. Online Casino said 1083 days later:

    I love this post.

  17. Web Hosting said 1083 days later:

    I love this post. Expecting more like this.

  18. credit card said 1083 days later:

    Awesome.

  19. insurance said 1083 days later:

    I read it. Its good.

  20. biofuel said 1083 days later:

    Good post.

  21. Consulting Online Scheduler said 1087 days later:

    Thanks this really helped me out….

  22. Florida Drug Rehab said 1089 days later:

    Its a great pleasure reading your blog. The blog content is powerful.Very Good.

  23. Addiction Treatment said 1089 days later:

    Its a nice comment.I love reading it in detail and bookmarked it.I found some real value in the content.Loved it.

  24. Drug Rehab Florida said 1089 days later:

    Its a great pleasure reading your post.Its full of information I am looking for and I love to post a comment that “The content of your post is awesome” Great work.

  25. Cheap Domain Names said 1090 days later:

    Great post, I look forward to reading more.

  26. The Employment Law Group said 1091 days later:

    Truely nice post.

  27. chase auto loan said 1092 days later:

    Extremely helpful. I like the way you have written. Do you have an RSS feed?

  28. chase personal loans said 1092 days later:

    This post really great one.I would like to appreciate your work and would like to tell to my friends. Thanks for sharing the sign-on information, given the restrictions of HTTP.

  29. piyush group said 1092 days later:

    nice post i had bookmarked your blog, feel free to visit my blog at piyush group.

  30. send flowers to kolkatta said 1092 days later:

    thanks for nice post i am really happy after reading contentof ur post or you cansend flowers to kolkata

  31. Online Casino said 1092 days later:

    Its very good post.I like it.

  32. send flowers to chennai said 1094 days later:

    nice post i am really happy after reading contentof ur post or you cansend flowers to chennai

  33. send flowers to delhi said 1094 days later:

    nice post i am really happy after reading contentof ur post or you cansend flowers to delhi

  34. web design jaipur said 1094 days later:

    nice post i am really happy after reading content of your post or you canweb design jaipur

  35. web hosting mumbai said 1094 days later:

    nice post i had bookmarked your blog end .i had very much like this

  36. web development said 1095 days later:

    Thanks for the information…keep on sharing…nice blog site….

  37. Business Cards said 1095 days later:

    Its my pleasure that I got an opportunity to comment on this post. Its a very nice post and I love it.

    Business Cards

  38. telecharger sonnerie gratuite said 1096 days later:

    Really impressed! Everything is very open and very clear explanation of issues. It contains truly information. Your website is very useful. Thanks for sharing. Looking forward to more!

  39. Lemon Removal said 1096 days later:

    I must say its a very good blog and I find it immense pleasure reading it. Junk Lemon | Cash For My Lemon | Cash For Lemon | Cash For My Lemon | Junk Lemon For Cash | Junk Lemons | Lemon Salvage | Sell Your Lemon | Salvage Lemon | Sell Junk Lemon

  40. Power Transmission said 1096 days later:

    Thanks

  41. The Employment Law Group said 1098 days later:

    Its a pleasure reading your post.

  42. Learn SEO said 1100 days later:

    if that fails verified against a relational database. For NTML users we’ll need to get the groups out at some point, presumably from LDAP.

  43. cheap guitars said 1101 days later:

    1) Something similar to OpenID, maybe actually using the OpenID protocol. Write a server which the web applications redirect to if authorization fails for some request. There are OpenID interfaces for plone and AuthKit. But there is a question as to whether the OpenID spec would allow returning of the list of groups a user belongs to.

  44. Underground Guitarist said 1101 days later:

    Have the proxying Apache authenticate users and put this information in the environment. This would work if we only wanted to protect whole directories. An Apache module to help with this is mod_auth_tkt, which does rather more. Unfortunately it still doesn’t allow you to redirect users when authorization is required. What is needed is some way of catching a 401, as is done by AuthKit,

  45. miami pre owned cars honda said 1101 days later:

    If you use Active Directory you could have each app use AD for authentication, login could then be seamless. Otherwise, if the applications can talk to each other behind the scenes, you could use sessionids and have one app handling id generation serving all of your other applications.

  46. free arcade games said 1102 days later:

    really good post i had read your post and bookmarked your post further knowledge.

  47. Indian baby names said 1102 days later:

    nice post i had read your post and bookmarked your post further knowledge.

  48. web design jaipur said 1102 days later:

    Really thankful good post i had bookmarked your blog end. i had very much like this.

  49. Background Check said 1108 days later:

    I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your web site to check out the latest stuff you post.

  50. Diaper Bags - Baby Bag said 1110 days later:

    play with it, right away. Will post updates. Cool bit.

  51. dental implant dentist said 1111 days later:

    play with it, right away. Will post updates. Cool bit.

  52. seo said 1112 days later:

    you can specify a mod_auth_tkt directive in apache conf file like the following:

  53. Online PhD in Chemistry said 1113 days later:

    Its a very good post, i had subscribed your post.Please update the latest information.

  54. seo said 1113 days later:

    you shown nice tips which will help us in future… thanks for this article..

  55. Online Advertising Agencies said 1116 days later:

    Thank for the amazing post…I have bookmarked the website….

  56. Generators said 1117 days later:

    WoW Great post.I love to read more stuff like this.

  57. Fishing Hats said 1119 days later:

    This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value of providing a quality resource for free. It is the old what goes around comes around routine. Did you want to acquired lots of links and I see lots of track backs??

  58. Rehab New Jersey said 1123 days later:

    Nice blog with very strong content. I love reading it over again.

  59. car hire kerry said 1127 days later:

    car hire kerry

  60. Hire a car Bergamo said 1127 days later:

    Hire a car Bergamo

  61. car hire portugal said 1127 days later:

    car hire portugal

  62. car hire italy said 1127 days later:

    car hire italy

  63. car hire ireland said 1127 days later:

    car hire ireland

  64. car hire france said 1127 days later:

    car hire france

  65. sports betting online said 1127 days later:

    sports betting online

  66. casino online said 1127 days later:

    casino online

  67. web hosting news said 1127 days later:

    web hosting news

  68. web hosting guide said 1127 days later:

    web hosting guide

  69. host guide said 1127 days later:

    host guide

  70. injury lawyer said 1129 days later:

    Nice to be visiting your blog again, it has been months for me. Well this article that i’ve been waited for so long. I need this article to complete my assignment in the college, and it has same topic with your article. Thanks, great share

  71. office chairs said 1132 days later:

    In recent days we need some application which works faster….. I welcomes this blog….

  72. casino en ligne said 1134 days later:

    Is Awesome to Read your Post,I Really like it,I think to make the same application like it,Thanks

  73. Watch Fifa Worldcup 2010 Online said 1135 days later:

    Remember you will not always win. Some days, the most resourceful individual will taste defeat. But there is, in this case, always tomorrow – after you have done your best to achieve success today.

  74. rolex watches said 1136 days later:

    It is a great pleasure got an opportunity to comment on this post. Its a very nice post and I love it.

  75. Dining Table said 1137 days later:

    Its my pleasure that I got an opportunity to comment on this post. Its a very nice post and I love it

  76. Helmore said 1139 days later:

    This was a useful post and I think it is rather easy to see from the other comments as well that this post is well written and useful. Keep up the good work.

  77. California Loan Modification said 1140 days later:

    I am grateful to you for sharing this post with us. I have been in search of this post and found the post at the right time. I appreciate for your hard work.

  78. ortho home defense mouse traps said 1143 days later:

    Really a nice Article i gives me a lot of information thaks for suck a good article…..................

  79. Print on Canvas said 1143 days later:

    Fine information, thanks to the author. This work is really useful and significant.

  80. DVD Replication said 1143 days later:

    I happen to enter your blog with the help of Google search. To my sheer luck I got what I was searching for. Thanks

  81. Family Movies said 1143 days later:

    Generally I do not post on blogs, but I would like to say that this post really forced me to do so, Excellent post!

  82. chiropractic saint paul said 1143 days later:

    You have a point. Very insightful. A nice different perspective.

  83. chat software said 1147 days later:

    Well, the info your share here is great and informative to me as I am very new to the subject. But I love reading and getting some more knowledge on it. Thanks

  84. west nile virus said 1150 days later:

    Nothing is useless in this article…..

  85. Hosting Packages said 1153 days later:

    I love this post. Expecting more like this.

  86. Opiate Detox said 1154 days later:

    Great site you got here and all the posts are really worth the read. I was wondering if I could use some write-ups on my website, I will link back to your website or page where I took the article to properly cite the source. If this is a problem please let me know and I will take it down right away. Best regards – Karen

  87. SEO Services India said 1158 days later:

    There are OpenID interfaces for plone and AuthKit. But there is a question as to whether the OpenID spec would allow returning of the list of groups a user belongs to.

  88. cheap iphone said 1161 days later:

    great site. very good stuff.

  89. Roland said 1170 days later:

    Thanks a lot for your good advice – really appreciated.

  90. los angeles seo company said 1170 days later:

    OpenID interfaces for plone and AuthKit. But there is a question as to whether the OpenID spec would allow returning of the list of groups a user belongs to.

  91. Justin Bieber said 1175 days later:

    Thanks ones again for this great blog.Thanks

    >>>>>!!<<<<

  92. search engine optimization services said 1175 days later:

    Not too many people would actually think about this the way you just did. I’m really impressed that there’s so much about this subject that’s been uncovered and you did it so well, with so much class.

  93. Indiana DUI attorney said 1176 days later:

    A directory is a set of objects with attributes organized logically in a hierarchical manner. A simple example is the telephone directory, which consists of a list of names (of either persons or organizations) organized alphabetically, with each name having an address and phone number associated with it.

  94. Dubai Property said 1177 days later:

    I like your post & i will always be coming frequently to read more of your post.Thank you very much for your post once more.

  95. Dubai Real Estate Agents said 1177 days later:

    The internet is with a doubt growing into the most important medium of communication across the globe and its due to sites like this that ideas are spreading so quickly.

  96. Social Networking said 1178 days later:

    Thanks for info- I really love this site!

  97. 6S said 1178 days later:

    I would like to say that this post really forced me to do so, Excellent post!

  98. Cheap Calls said 1180 days later:

    Savvytel is a prepaid mobile offering Mobile Prepaid, Mobile Post Paid, Prepaid Mobile, Cheap Calls, Mobile Plans, 3g Mobile, prepaid phones, Phone Prepaid, 3g Prepaid, Recharge Prepaid, Best prepaid on the vodafone network.

  99. Image Consultant said 1180 days later:

    I would like to share it with all my friends and hope they will like it too.

  100. MAS 90 Customizations said 1180 days later:

    Fine information, thanks to the author. This work is really useful and significant.

  101. Website Optimization Company said 1180 days later:

    Good post….thanks for sharing.. very useful for me, I will bookmark this for my future needs.

  102. Accident Insurance said 1182 days later:

    Everything is very open and very clear explanation of issues. It contains truly information.

  103. fm stereo transmitter said 1182 days later:

    if that fails verified against a relational database. For NTML users we’ll need to get the groups out at some point, presumably from LDAP.

  104. lalique said 1185 days later:

    Great post. keep it up.

  105. hi said 1185 days later:

    This post is really well written as it has provided all detailed facts and information about the topic. This post speaks credibility and authenticity and exposes real caliber of the writer. Doing business in UK

  106. Funeral Insurance said 1191 days later:

    I am happy to find your distinguished way of writing the post. Now you make it easy for me to understand and implement the concept.

  107. glass brooklyn said 1192 days later:

    Very good job.

  108. spray foam insulation said 1193 days later:

    Great site.

  109. online bingo bonus said 1193 days later:

    Really impressed! Everything is very open and very clear explanation of issues. It contains truly information. Your website is very useful. Thanks for sharing. Looking forward to more!

  110. pa personal injury said 1193 days later:

    Keep this going…

  111. tiffany earrings said 1194 days later:

    Generally I do not post on blogs, but I would like to say that this post really forced me to do so, Excellent post!

  112. window cleaning service said 1195 days later:

    The internet is with a doubt growing into the most important medium of communication across the globe and its due to sites like this that ideas are spreading so quickly.

RSS feed for this post

(leave url/email »)

   Comment Markup Help Preview comment