I need to implement an SSO solution with the following requirements:
- Cross-domain: Let's assume I have
a.com
,b.com
andsso.com
. If I become logged in througha.com
, I shouldn't need to login when I visitb.com
. - Centralized: Unlogged user clicking "Login" on
a.com
is shown a login screen hosted onsso.com
. Credentials are checked bysso.com
in data source only accessible to it. - Auto-login: If the user has logged in to
a.com
, and subsequently visitsb.com
, they will be immediately logged in. I.e., onb.com
, instead of a "Login" link, we want to display right away their username, etc - without the need to click anything. - No redirect for anonymous users: Vast majority of my users will use the sites without having an account. Therefore, when they first come to
a.com
, orb.com
, there must not be a quick redirect of the entire page tosso.com
and back to check if they are logged in. Such a redirect would be bad for SEO and latency.
For the few users who have logged in to a.com
and then go to b.com
(or vice-versa), a redirect is acceptable.
There's a lot of examples on the web for SSO, especially with OAuth2, OpenID Connect, and CAS, but I could not find a recipe for these specific requirements. The closest is the Stackoverflow SSO guide (here), but they have some extra requirements I don't have (e.g. login should still work if SSO server is down).