Re: Re: Singe Sign On

Ammar Ibrahim wrote:

Alan Knowles wrote:

I've had mild success with pubcookie [google for it], the signup stuff is simple and works ok, however we still havent figured a clean signup strategy for it..

What do you mean by clean signup strategy?

pubcookie is perfect for the user authentication stuff, but has zero code to deal with signing new users up, and automatically logging them in.. (eg. a signup.) - and since it's written in C, it's a little complicated to interface with.

I've done other research on this for another project, it ended up using hidden iframes, header(location:) redirects, cookies and a few md5 checksums to do a similar thing. (unfortunatly I dont own the code or spec document from that now, but the concept is pretty simple)

I'm not sure about this, doesn't sound like a good idea. I want to keep things simple for any programmer trying to authenticate using SSO on any member site. I want it to be as simple as an include file, then a couple of function calls that does everything.

The actually authentication is always done on the server, - all this could probably be simplified down to a small libray, the end result of my code was only about 2 function calls needed in the application + one basic php script on the slave server, and a few scripts on the master login server. None of the solutions that require you to implement a signon server could be regarded as simple though...

Another question is what about user profiles? for example let's assume we want to create a dating service. ( dating.example.com) Profiles for such sites are huge, ( height, eyes, ...etc ) so I suppose I need to store the profiles on the dating service database. so, SSO will only store usernames/passwords But the problem is that what if two services are storing the NAME. then I don;t want to have redundant copies of that... oh, things are getting complex :D

yeap - you usually end up with some duplication - I used SOAP to send stuff back and forth occasionally, otherwise relying on the browser redirect process, with some variable flying off the end of the redirects. Regards Alan

Thanks Alan, Ammar

Regards Alan Ammar Ibrahim wrote:

I want to build an SSO for some company. I would like to know if anyone has some ideas where to start? I know that LiveUser might include an SSO thing in the future, but I really don't wanna go for that. Here are some ideas: 1- It must integrate easily with other applications, preferebly without any modifications. e.g. If i decide to install a web mail system, I want it to authenticate against my SSO. 2- Can LDAP help here? 3- I'd like to put SSO on a seperate server, so maybe XML communication might sound like a good idea, XML-RPC anyone? 4- This is a high traffic site, performance is a critical issue. I would appreciate any ideas here. Ammar Ibrahim