问题
I have read several articles about sso but could not find an answer in my mind. I have a scenario like below:
Scenario:
- My company wants to have sso mechanism using jwt.
- Company has 2 different domains like abc.com as abc and xyz.com as xyz.
- Also there is a masterdomain that manages clients authentication.
- User X wants to log in abc at first.
- abc sends credentials to masterdomain and masterdomain authenticates user then create a signed jwt in order to send back to abc.
- abc keeps this jwt in a cookie.
- After a while if a login to abc is attempted at the same computer, system does not ask for credentials and automatically login the user.
Question:
If user tries to open a page in xyz domain, how does the system understand that the user loggedin before? I mean xyz domain cannot reach the cookie of abc which has the jwt. What information should be sent to xyz that indicates the user X is trying to login?
Thanks in advance
回答1:
You can store the JWT authentication token in a cookie / localStorage of a intermediate domain connected to the home page using an iframe
Scenario
abc sends credentials to masterdomain and masterdomain authenticates user then create a signed jwt in order to send back to abc.
abcmasterdomain keeps this jwt in a cookie.After a while if a login to abc is attempted at the same computer, system does not ask for credentials and automatically login the user.
Finally when the user enters in the second domain xyz, the jwt is recovered from masterdomain storage using the iframe, and automatically login the user
CORS is not a problem because masterdomain.com have access to its storage and communication between iframes is allowed if origin and destination are recognized (see http://blog.teamtreehouse.com/cross-domain-messaging-with-postmessage)
To simplify development, we have released recently an opensource project cross domain SSO with JWT at https://github.com/Aralink/ssojwt
来源：https://stackoverflow.com/questions/40527124/single-sign-on-sso-using-jwt