Authentication Across Sites

Question

I have 2 sites:

SITE A - an asp.net site
SITE B - a php site

We have all the user information in an asp.net site (which is actually a Kentico site). Now, there is a business requirement that users should be able to log-in with the same credentials in Site B. Ideally, we would need that users who log-in Site A, and navigate to Site B, the authentication would be automatic.

Is there a way to achieve this form of authentication. Or is it not possible?

You would need to think heavily about security, but couldn't you use a cookie? — Mattt, Jan 03 '13 at 16:47

palako · Accepted Answer · 2013-01-03T16:55:04.590

3

This is not an authentication problem, but an authorization one. Once you have authenticated your user, in whichever way you want, with whichever technology you want, you probably will grant them some sort of token that you will then use to grant authorization to the different resources in your sites.

In your case you have two different technologies, which only means that you won't be able to use the out of the box asp.net or php session management, but all you need to do is have a common place to check that the session tokens are valid, they belong to a legitimate user and that user has permissions to access this resource.

If the above is trivial, sorry, maybe your question is more oriented to the sites being in two different domains, and therefore not being able to use a domain cookie to store the session information. is that the case?

edited Jan 03 '13 at 16:55

answered Jan 03 '13 at 16:49

palako

3,342
2
23
33

1

Thanks for your detailed reply. Yes, the session token would make sense. I think that it would still be possible to still keep using out of the box asp.net state, perhaps I could share the session state in the url? or maybe a cookie (perhaps easier if it is in a sub domain) – Joseph Caruana Jan 03 '13 at 19:29
If you want to authenticate in site A and then site B is neither the same domain nor a subdomain, you can't relate them automatically, that is, as soon as site B is visited, know that it needs to take something from the browser belonging to site A's domain and use it. But yes, a subdomain would solve the problem, you can share cookies across subdomains. – palako Jan 03 '13 at 22:02

score 3 · Answer 2 · answered Jan 03 '13 at 17:16

The canonical solution to this is to use a protocol like OpenID. OpenID allows a website to ask a user to authenticate themselves using a different site, and then honour those credentials; using a protocol called "attribute Exchange", the authentication provider can provide additional data about the user.

OpenID is how StackExchange manages to log you in with your Google account (or whatever you're using), and how sites in the SO network recognize your identity without you logging in everywhere.

The benefit for OpenID is that it's a widely used protocol, so it's likely to be highly secure and well-tested; you don't risk weaving your own solution and accidentally exposing your users to security risks. It's well-documented, and widely supported.

There's an OpenID framework for .Net which allows you to create your own OpenID provider; it appears Kentico supports OpenID as an authentication mechanism. There are several OpenID libraries for PHP (Google is your friend here).

Exactly how you implement this depends on how your Kentico authentication works right now, but in principle it should be fairly easy to glue the Kentico user database to an OpenID provider you write; getting Kentico to use that for authentication appears to be a configuration setting. You'd have to re-write the PHP site to use OpenID; again, not clear how that currently works, but I can't imagine it would be harder than any other solution you might try.

+1 for suggesting open Id, but I think we will go with the option provided by the other user. Thanks a lot for your valuable input — Joseph Caruana, Jan 04 '13 at 10:06

score 2 · Answer 3 · edited Feb 08 '13 at 20:19

I had a similar issue on a .net platform where I didn't have the option to put them on one subdomain. In that case you could pass the username and a token (that signified the user was already authenticated by site B) and perhaps the encrypted password to re-authenticate against an external DB, then redirect them to the site. In my case I needed to do this as I was redirecting to the corresponding site CMS for site admins.

Authentication Across Sites

3 Answers3