-
Notifications
You must be signed in to change notification settings - Fork 53
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSO from a third server and JWT based REST authorization from the app server #15
Comments
I still am lost. So there are two services running on two distinct servers:
Use goes from browser |
User goes from browser B to |
That sounds an awful lot like oauth2. Why not just use it? |
I don't see oauth2 here since the it sounds a lot like SSO/ SAML to me. |
Yeah, it isn't exactly oauth2, more a variant of some SSO variety. You are saying that when the user goes back to |
Yes. The one already issued to |
There are two sides to this here:
What you are saying would work (mostly) out-of-the-box if you ran cansecurity on each of The only issue then is browser side. You would need to implement it browser side, to capture the |
Yes, it will work out-of-the-box if cansecurity is run on both Should And for the |
Correct.
Yes, although as it grows, I tend towards the dedicated login server setup. That having been said, in a recent project, we use an API Gateway in front of everything, so it looks like the same server, but there is only one auth_server microservice in the background.
Yes. I will say, though, that I would like to see a pubkey/privkey option, so that only the auth server needs the private key, and the app servers only need the public key.
That is a nice idea. In a single page app (which originally drove development), we are not restricted to what cookies can do, we have some dynamic control. Go ahead and open a PR with an option to use a cookie with configurable domain. Anything else to add here? |
BTW, what are you using this for? Piqued my curiosity. |
It is a toy app where a set of people can record texts and another set of people can view them like in a feedback system. |
I would like to use a node server to authenticate users on behalf of apps (on sub domains) running on different node servers. and then authorize the routes using stateless sessions/ JWT.
Scenario: consider A1 and A2 are apps on servers S1 and S2 respectively. S be the authentication server
Note: authentication should be done only by S (validation in one place).
Also, any improvements in the design that fits within cansecurity?
Thanks in advance for the help
The text was updated successfully, but these errors were encountered: