24

I have read several articles about sso but could not find an answer in my mind. I have a scenario like below:

Scenario:

  • My company wants to have sso mechanism using jwt.
  • Company has 2 different domains like abc.com as abc and xyz.com as xyz.
  • Also there is a masterdomain that manages clients authentication.
  • User X wants to log in abc at first.
  • abc sends credentials to masterdomain and masterdomain authenticates user then create a signed jwt in order to send back to abc.
  • abc keeps this jwt in a cookie.
  • After a while if a login to abc is attempted at the same computer, system does not ask for credentials and automatically login the user.

Question:

If user tries to open a page in xyz domain, how does the system understand that the user loggedin before? I mean xyz domain cannot reach the cookie of abc which has the jwt. What information should be sent to xyz that indicates the user X is trying to login?

Thanks in advance

baris usanmaz
  • 839
  • 1
  • 13
  • 31

1 Answers1

24

You can store the JWT authentication token in a cookie / localStorage of a intermediate domain connected to the home page using an iframe

cross domain sso

Scenario

  • abc sends credentials to masterdomain and masterdomain authenticates user then create a signed jwt in order to send back to abc.

  • abc masterdomain keeps this jwt in a cookie.

  • After a while if a login to abc is attempted at the same computer, system does not ask for credentials and automatically login the user.

Finally when the user enters in the second domain xyz, the jwt is recovered from masterdomain storage using the iframe, and automatically login the user

CORS is not a problem because masterdomain.com have access to its storage and communication between iframes is allowed if origin and destination are recognized (see http://blog.teamtreehouse.com/cross-domain-messaging-with-postmessage)

To simplify development, we have released recently an opensource project cross domain SSO with JWT at https://github.com/Aralink/ssojwt

Community
  • 1
  • 1
pedrofb
  • 37,271
  • 5
  • 94
  • 142
  • what about the security if there is a phishing website which user entered and the user will lose the access token? does **ssojwt** corver this case? – Vunb Feb 27 '18 at 02:35
  • 3
    @Vunb, iframe `postmessage` function requires that the origin and destination sites must be previously authorized, otherwise the browser will not allow the messaging, so an attacker can not access the shared token because it is not in the white list – pedrofb Feb 27 '18 at 06:59