对不同子域下的不同应用程序进行集中身份验证。

Question

I have two applications running under the same base domain.

docs.application.com goes to the documentation and it's written with PHP (Grav CMS).

www.appliation.com goes to my application which is written with Node and React.

Grav CMS has a Google oauth plugin that I am using and my application also uses Google oauth to login.

I would like to centralize the login on a way that I could login to any of the applications and be automatically logged in to the other one.

I've been reading about Central Authentication Service and Cross Domain Login but so far I wasn't able to manage a solution.

Any thoughts?

Answer 1

You have tagged this question with OAuth2 so I am telling about that.

Technically speaking OAuth2 is not Authentication tool but Authorization tool. However you can tweak it in such a way that you can use it for authentication.

Ideally you should create another application only for Authentication, say sso.example.com. All two application will go to that for Authentication.

In any SSO tool you use, your both application will become you 'service provider' and the sso application will become your 'identity provider'. You can use Shibboleth too for that matter.

If you use OAuth2 than only thing you will have to manage on client side is the token. While shibboleth does that for you. Shibboleth act as authorization server too. You can configure it in such a way that, all two application will be not accessible unless user has active session in the SSO application.