适用于多产品的Google Single Sign On体系结构

Question

I have two products on individual Amazon cloud server with their own database including user management.

Now, I am planning for making centralize user management(SSO), for example,

• AdminDb (user master goes here for all product)
• Product1Db
• Product2Db

I am not database expert, is it right way to do this? Is there any already SSO service available?

How can I maintain transactions of any user in each product database, since user master in different server & database?

Kindly note, I have kind of similar architecture with Google having different domains. Let me know if you need any other information.

Answer 1

I am not database expert, is it right way to do this? Is there any already SSO service available?

You can use Amazon Cognito User Pools which is a fully managed user store and identity service you can use to authenticate users and optionally also to authorize (Using Cognito Users & Groups). You can either use Cognito Hosted UI or Build the login page by your own using AWS SDKs .

Note: The example is for NodeJS, for Java use the relevant methods from AWS JavaSDK .

How can I maintain transactions of any user in each product database, since user master in different server & database?

In the identity service, you won't be storing business related information of the user (Which is typically stored in the product database). Therefore if you have any data to store in relation to the user for a product, use an identifier from the identity service(id or email or etc.) in individual application databases.

Having said that, you can still use your own application for authorization (Using the identity service eg AWS Cognito User Pools for authentication). If so you can asynchronously replicate the user permissions to other product databases (Decentralized user permissions) so that, individual product can self sustain. You can use AWS SNS (Pub-Sub messaging for this).