separate oauth2 and web server

Question

Suppose my site is example.com

When a user at a client.com wants to login via example.com (with oauth2)

1. He comes to oauth.example.com/authorize and oauth.example.com knows he's not signed in to web.example.com .

2. oauth.example.com redirects him to web.example.com

3. he logs into web.example.com then gets redirect back to oauth.example.com

4. oauth.example.com somehow knows that he is logged into web.example.com

5. oauth.example.com does its oauth2 magic and sends him back to client.com

My question is, how should oauth.example.com should detect if a user is logged in or not with web.example.com .

I'm considering to let web.example.com to store session data in DB, and have oauth.example.com to look up the db.

My concern is that when session expires (without user explicitly logging out), it might be possible for the two servers get out of time-sync.

A user (A) might refresh web.example.com and find out his session is expired and leave the computer open.
Another user (B) might click login with example.com and oauth.example.com might consider (A) user is still logged in (because time is not well synchronized).

Would synchronizing clock with nptd be best I could do?
Or should I scrap this idea and come up with something else?

• implementation detail: I'm considering spring-session-jdbc, and it unfortunately doesn't remove session data on every expiration.

Answer 1

Your oauth.example.com should provide the login page. The oauth.example.com must be Authorization server (rfc6749). When the web.example.com request user login, the login url should redirect to the oauth.example.com login page.

The oauth.example.com provider login authentication (identity verify), then back the web.example.com. If login success, the web.example.com will switch token with oauth.example.com.

I'm considering to let web.example.com to store session data in DB, and have oauth.example.com to look up the db.

You can treat the Oauth access token and Oauth refresh token as cookies or a session id for oauth.example.com in your web.example.com server.

My concern is that when session expires (without user explicitly logging out), it might be possible for the two servers get out of time-sync.

The oauth.example.com must have revoke token api.