LDAP 上的 Spring-security 3.1 单点登录

Question

I'm trying to add single sign on to two legacy systems on different domains. That currently have working "regular" login. I found this https://stackoverflow.com/a/9925146 but I'm unsure about the step 1 more specifically this "implement functionality to serialize and write the Authentication object to a Session cookie with a global scope." If I understand this correctly I should extract the sessionID and add it to a new cookie with a global scope.

I started by trying to extract the sessionID like so

import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.authentication.WebAuthenticationDetails;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;


import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;


public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
                                        HttpServletResponse response,
                                        Authentication authentication) throws IOException,ServletException {
        Cookie cookie = null;
        UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;

        if (authentication.getDetails() != null) {
            WebAuthenticationDetails dets = (WebAuthenticationDetails) auth.getDetails();
            System.out.println("sessionID: " + dets.getSessionId());
            
        }


        response.addCookie(cookie);

        super.onAuthenticationSuccess(request,response,authentication);
    }
}

To verify that I'm on the right track i print the sessionID to terminal and compare it to the sessionID that spring-security sets in the browser. If I understand correctly they should match. They don't match. Am I misunderstanding the solution suggested in the answer?

Answer 1

Single sign on is a very difficult problem to get right. I really would not recommend attempting to implement it unless you have a good grasp of the problem and how to solve it. If you can I highly recommend you try to use Oauth2 instead of implementing it yourself.

https://www.baeldung.com/sso-spring-security-oauth2 might give you a starting point.

If you are using an application server like JBoss or WebSphere you may be able to use their SSO option instead.