Single sign-on for intranet?

Question

I'm trying to set up a single sign-on for my intranet. I've found a couple solutions online but I'm not sure if they apply to my particular situation.

I have several subdomains on the same server. One level of user should be able to access all subdomains and another level of user should only be able to access some subdomains.

Signing into one subdomain should make it so you don't have to log into any others.

Can anyone point me in the right direction? I'm on Ubuntu using Apache.

score 1 · Accepted Answer · answered Sep 30 '10 at 20:30

I'm not 100% sure of the solution, but I'm fairly certain you can run an LDAP server and have apache authenticate to it through the use of mod_ldap. You might want to scope out this article to see if it's what you want:

http://www.linux.com/archive/feature/120050

From there you should be able to create user groups in ldap and configure apache to reflect group access for different folders.

Fair warning, I've never actually done this before, so it might not be what you want.

Also, it looks like apache now has its own directory server project, I've only ever used Fedora-DS now 389-DS, should be pretty similar though:

http://directory.apache.org/

I'm sure this is the best answer. However, the stuff in those links is over my head. I'm going to do what I did with my DNS server when I couldn't figure it out with the internet: buy the book. — Jason Swett, Oct 04 '10 at 17:38

score 1 · Answer 2 · answered Sep 30 '10 at 20:31

1

How will you authenticate your users? PHP/mysql? if so you could just use cookies

answered Sep 30 '10 at 20:31

trozz

557
2
12

Cookies don't usually cross domains – symcbean Oct 01 '10 at 10:58
1

@symcbean OP has subdomains on the same domain, so cookies will work in this situation. – Evgeny Jun 21 '12 at 02:06

Evgeny · Answer 3 · 2012-06-21T02:23:42.547

Here is what I propose (situation of strictly Intranet - subdomains of the same web domain):

On the identity provider after main authentication code call a method that:

sends encrypted data about logged in user to the consumer
receives and verifies the response with the signed login cookie
returns name and value of the cookie

after the method is returns - set the cookie for the subdomain.

On the identity consumer service:

receive data of the method
decrypt it
if user does not exist, create his/her account
determine the session cookie
sign the cookie
send the cookie name, value and the signature back to the identity provider

This is easier to set up than OAuth, LDAP etc, but will work only with the subdomains, given that cookies cannot cross domain bounds.

Single sign-on for intranet?

3 Answers3