Detailed description of the Cross-origin Single Sign-On (SSO) implementation solution [with. net Code], sso.net

Detailed description of the Cross-origin Single Sign-On (SSO) implementation solution [with. net Code], sso.net

SSO Introduction

Definition:

The traditional single-site logon authorization mechanism is: after successful logon, the user information is saved in the session, and the sessionId is saved in the cookie. Each access to the resource (url) that needs to be accessed) to determine whether the current session is empty. If it is empty, the system will jump to the logon page to log on. If it is not empty, access is allowed.

Single Sign-On (spof) is a multi-site shared login access authorization mechanism. Users only need to log on to one site to access the resources (URLs) that other sites need to log on ). If you log out of any site, the logon status of other sites is also canceled. In short, it is: one login, login everywhere. Cancel a cancellation.

Application scenarios:

When a website system is a little more complex, you need to split the business. For example, an e-commerce website can split product search, product details, shopping cart, and orders into subsystems ,. When a system is split into multiple subsystems, single-point logon is required for authorization.

Business Requirements:

Recently, due to business needs, the company developed subsystems that need to be integrated with the main site. After reading a lot of Single Sign-On tutorials on the Internet, the company summarized the following single sign-on Implementation ideas based on various situations. The Round-Robin jump method is used to solve the problem of writing cookies to multiple substations at the same time. If you have any questions, please criticize and correct them.

Functions:

1. Complete cross-Origin

2. url transparency (do not need to pass the token or ticket in the url for substation jump)

3. synchronous logout

4. Write the cookie to multiple substations at a time

Effect preview:

Implementation

Implementation difficulties:

The difficulty of this method is: how to write the cookie to B .com at the same time during a.com login. I am using sso.com to maintain a collection of sub-stations, and write the cookie to each sub-station in the round-robin jump mode after successful login.

Specific ideas:

1. access a.com for the first time-> click the logon button on the.com page-> jump to sso.com for Logon verification-> store data in the cache after successful logon-> then access the sub-sites in turn by polling and write the cookie to each sub-station-> finally jump to the logon Source Page

2. After Successful Logon, go to the resource (url) You want to log on to and send a request to sso.com in the background to verify the cookie validity.

Code Analysis

1. Three new sites: a.com, B .com, and sso.com

2. Create the home/index page in a.com as follows:

The cookie for the first access does not exist. when the request is sent to sso.com/login/validateloginfor verification, the error is returned, and the page displays the error status.
The corresponding view page is as follows:

Code of sso.com/login/validatelogin:

3. Click the logon button on the.com homepage to go To the logon page (login/index) of sso.com)

The logon code in 4.sso.com is as follows:

5. Click login to enter the logon Verification Method

Generate a token, and save the user information with the token as the key and set the expiration time.

Obtain the substation collection, write the cookie to each substation in sequence by means of redirection round-robin, and finally redirect to the login Source Page

The logon authentication method is as follows:

The following code redirects from a.com and B .com to write cookies:

/// <Summary> /// write the cookie as a jump // </summary> /// <param name = "token"> token for authorization verification </param> /// <param name = "others"> a series of sub-stations </param> /// <param name = "main"> sites returned after successful logon </param> /// <returns> </returns> public ActionResult Jump (string token, string others, string main) {HttpCookie cookie = new HttpCookie ("currentUser"); cookie. httpOnly = true; cookie. expires = DateTime. now. addYears (100); // never expire cookie. value = Token; Response. Cookies. Add (cookie); // subtract the sub-site that has already written Cookies in turn if (! String. isNullOrEmpty (others) {// obtain the substation set var substationList = others. split (new char [] {','}, StringSplitOptions. removeEmptyEntries ). toList (); if (substationList. count = 1) {return Redirect (others + "& main =" + main);} else {string currentRedirect = substationList [0]; substationList. removeAt (0); string otherss = string. join (",", substationList); return Redirect (currentRedirect + "& others =" + otherss + "& main =" + main );}} else {return Redirect (main); // jump to the logon Source Page }}

6. Return to the logon Source Page a.com/home/index# B .com/home/index.

At this time, both a.com and B .com already have cookies.

7. logout (logout) Processing

To log out, call sso.com/login/loginoutlogs directly, as shown below:

Summary

In this way, the user login information is stored in sso.com as a cache, And the cache key is saved as a cookie value in each sub-station to implement cross-origin single-point logon.

The difficulty of this method is: how to write the cookie to B .com at the same time during a.com login. I am using sso.com to maintain a collection of sub-stations, and write the cookie to each sub-station in the round-robin jump mode after successful login.

This method also has some problems while implementing cross-origin Single Sign-on:

1. ajax logon is not considered.

2. Security Verification is not performed (IP Trust, cookie hijacking, brute force login ......)

Considering the shortcomings, I sincerely hope you can put forward good ideas and comments.

DEMO download: demo

The above is all the content of this article. I hope it will be helpful for your learning and support for helping customers.