Using Apache's mod_auth across multiple sub-domains for single sign-on?

Question

I have a domain and a group of sub-domains that require authentication to access. I am currently using mod_auth to authenticate users (mod_auth basic) at the domain.tld level. My goal is for single sign-on between the domain and all the sub-domains.

Will these credentials carry on to the sub-domains automatically, or with a simple vhost config change, or is there a better method to do this?

Answer 1

mod_auth_basic

Browsers distinguish areas that require HTTP authentication by a combination of the URL root and the name of the authentication realm.

Take for example, two domains each with a realm with the same name:

http://one.example.com/ with the realm "Please enter credentials!"
http://two.example.com/ with the realm "Please enter credentials!"

First a user visits one, is asked for credentials and enters them. Then the user visits two, the browser recognizes that the URL is different and thus asks again the user for her credentials.

This is a good thing, because otherwise www.badguy.com could set it up so that your browser sends over your online banking login.

In short: there is no way to solve your problem with basic HTTP authentication and standard HTTP clients.

mod_auth_digest

You could use mod_auth_digest instead, since with that you can specify more than one URI to be in the same "protection space". However, with this authentication method there are two new problems:

1. It doesn't scale very well, because you cannot use wildcard domains.
2. Browser compatibility is not as good. (See the documentation on how to make it work with IE.)