Single Sign On for Web Application

Question

I am looking for solution where users of register websites with us can access our application without explicit login into our application.

1. Websites owner will register with us to access our application
2. User will login into their website and see link of our website to access it.
3. Once user click on the link user will able to access it.
4. If user try to access this link through browser with login into their website then show error message.

Is there any way to to this through cookies, webservices or HTTTP post method etc

Answer 1

check out OpenID - http://openid.net/

Answer 2

Another option you can investigate is Windows Live ID. Of course the main drawback is it requires users to have Windows Live Accounts but this may or may not be an issue

Answer 3

Hmm, sounds like you want something like OAuth, http://oauth.net for the authorisation and OpenID, http://openid.net/, support to allow people to easily login.

Google has a hybrid protocol, OpenID + OAuth which allows to request for both user details and access token all at once, http://code.google.com/apis/accounts/docs/OpenID.html.

Answer 4

Microsoft Windows 2003 R2 introduced a product called Active Directory Federation Services (ADFS) out of the box that fits your description. ADFS provides single sign-on between multiple websites. This includes sites that are affiliated to your own but that you don't necessarily trust to open up an authentication API. ADFS integrates with AzMan for role based authorization and can authenticated against Active Directory, ADLS, etc...

If all you are looking for is basic single-signon this this solution is way overkill. Basically all they are doing are checking for an authenticated session and if one isn't found doing a 307 redirect to the federation server (authentication website) where the authentication form sits. Once a user logs in a cookie is set on the federation server and the user is redirected back to the original site with the sessionid attached as a URL variable. It is up to that site to retain a copy of the sessionid as cookie for its own domain.

I just recently went down the route of evaluating a number of SSO tools and found that if all I really wanted was single-sign on it was just way easier to roll my own solution similar to the one above.