使用JWT进行单点登录（SSO）

Question

I have read several articles about sso but could not find an answer in my mind. I have a scenario like below:

Scenario:

• My company wants to have sso mechanism using jwt.
• Company has 2 different domains like abc.com as abc and xyz.com as xyz .
• Also there is a masterdomain that manages clients authentication.
• User X wants to log in abc at first.
• abc sends credentials to masterdomain and masterdomain authenticates user then create a signed jwt in order to send back to abc .
• abc keeps this jwt in a cookie.
• After a while if a login to abc is attempted at the same computer, system does not ask for credentials and automatically login the user.

Question:

If user tries to open a page in xyz domain, how does the system understand that the user loggedin before? I mean xyz domain cannot reach the cookie of abc which has the jwt. What information should be sent to xyz that indicates the user X is trying to login?

Thanks in advance

Answer 1

You can store the JWT authentication token in a cookie / localStorage of a intermediate domain connected to the home page using an iframe

Scenario

• abc sends credentials to masterdomain and masterdomain authenticates user then create a signed jwt in order to send back to abc.

• abc masterdomain keeps this jwt in a cookie.

• After a while if a login to abc is attempted at the same computer, system does not ask for credentials and automatically login the user.

Finally when the user enters in the second domain xyz , the jwt is recovered from masterdomain storage using the iframe, and automatically login the user

CORS is not a problem because masterdomain.com have access to its storage and communication between iframes is allowed if origin and destination are recognized (see http://blog.teamtreehouse.com/cross-domain-messaging-with-postmessage )

To simplify development, we have released recently an opensource project cross domain SSO with JWT at https://github.com/Aralink/ssojwt