SSO Solution

Introduction to SSO

Single Sign-On (SSO) is an authentication solution that allows users to log in to multiple applications and websites through a single user authentication. This means users only need to enter their username and password once to access all mutually trusted systems, without needing to log in separately to each system.

Key Advantages of SSO

1. Improved User Experience: Users only need to remember one username and password, eliminating the hassle of repeated logins.
2. Enhanced Security: By centralizing authentication management, user data can be better controlled and protected, reducing the risk of password breaches.
3. Increased Efficiency: Reduces time wasted on multiple logins, improving work productivity.

Security Risks

Single Point of Failure Risk (单点故障风险)

If the SSO system experiences a failure, all applications or services that depend on it will become unavailable. This could lead to business disruptions, affecting user experience and the normal operations of the organization.

Mitigation Measures:

• Deploy a high-availability architecture (such as load balancing, active-standby mechanisms) to ensure the stability of the SSO system.
• Regularly back up system configurations and data, and establish a comprehensive Disaster Recovery Plan (DRP).
• During system maintenance or failures, provide a backup emergency authentication mechanism to ensure the continuity of critical business operations.

Risk of System Compromise (系统被攻陷的风险)

If the SSO system is attacked or breached by hackers, attackers could gain access to all applications and resources that rely on it, posing a significant security threat.

Mitigation Measures:

• Ensure the security of the SSO system by using the latest security protocols (such as TLS 1.3) and conducting regular security audits to reduce vulnerabilities.
• Implement network isolation and segmentation to restrict access to the SSO system.
• Monitor system logs and user behavior, and set up an Intrusion Detection System (IDS) to identify anomalous activities.

Risk of User Credential Disclosure (用户凭证泄露风险)

The biggest risk of SSO is that if a user's credentials (such as username and password) are compromised, attackers could gain access to all or most applications and resources on the network, causing widespread impact.

Mitigation Measures:

• Password Policies (密码策略): Require users to create strong passwords, update them regularly, and store passwords securely using encryption algorithms (such as PBKDF2, bcrypt).
• Multi-Factor Authentication (MFA) (多因素身份验证 (MFA)): Integrate 2FA or MFA into the SSO implementation process, requiring users to provide additional authentication factors (such as SMS verification codes, OTP, facial recognition, etc.). This can effectively reduce the risk resulting from credential disclosure.
• Login Monitoring (登录监控): Monitor login activities in real-time, detect anomalous behavior (such as multiple failed login attempts within a short period), and take corresponding measures.

Key Concepts

In a Single Sign-On (SSO) system, the Identity Provider (IdP) and the Service Provider (SP) are two key roles. SSO relies on a trust relationship between the Identity Provider (IdP) and the Service Provider (SP).

1. Identity Provider (IdP):

   Definition: The IdP is the entity responsible for verifying user identity and providing identity information. It manages users' authentication credentials (such as usernames, passwords, tokens, etc.) and provides this information to service providers that trust it.

   Examples:

   • Internal Enterprise IdP: Such as Microsoft Active Directory Federation Services (AD FS), which provides single sign-on services for internal enterprise applications.
   • Third-Party IdP: Such as CSG Account (南网账号), WeChat, Okta, etc., which provide authentication services for various third-party applications.

2. Service Provider (SP):

   Definition: The SP is the entity that provides a specific service or application. It relies on the IdP to verify user identity. The SP trusts the authentication information provided by the IdP and determines the user's access permissions based on this information.

   Examples:

   • Enterprise Applications: Such as corporate email systems, CRM (Customer Relationship Management) systems, ERP (Enterprise Resource Planning) systems, etc. These systems offer single sign-on functionality through the enterprise's internal IdP.
   • Online Services: Such as Cloud Drive (网盘), Xiaohongshu (Little Red Book), QQ Music, etc. These online services can provide single sign-on functionality via third-party IdPs (like WeChat or Alipay).

SSO Implementation Principles

Overall Architecture

• Application System (SP): The system that requires login
• SSO Client: Handles login and logout (provided as a separate jar package for the application system to reference)
• SSO Server (IdP):
  • Login Service: Processes user login requests.
  • Login Status: Provides login status verification and login information query services.
  • Logout Service: Processes user logout.
• Database: Stores user account information.
• Cache: Stores users' login status information.

Login Process

Token Method

1. User accesses the application system (SP):
   • The application system checks if the user is already logged in.
   • If not logged in, redirect to the SSO server.
2. SSO server handles login:
   • The user provides a username and password, and the server verifies the information.
   • Upon successful verification, the server stores the user's login status in the cache and shares a dedicated Token with the application system (different Tokens are used for each application system).
3. Application system obtains the Token:
   • The user is redirected back to the application system, which uses the Token to verify the user's identity.
   • Upon successful verification, the application system retrieves user information from the SSO server, and the user is logged into the application system.

Authorization Code Method

1. User accesses the application system (SP):
   • The application system checks if the user is already logged in.
   • If not logged in, redirect to the SSO server while transmitting the return URL.
2. SSO server handles login:
   • The user provides a username and password, and the server verifies the information.
   • Upon successful verification, the server generates a one-time Authorization Code and redirects to the application system.
3. Application system uses the Authorization Code:
   • The application system exchanges the Authorization Code for user information and credentials by interacting with the SSO server.
   • The application system verifies the user's identity based on the credentials, stores the user's status, and manages it independently.

Comparison and Pros/Cons

Token Method

• Advantages:
  • Simple to implement, provides direct status sharing, and further reduces the implementation complexity of application systems.
  • Enhances performance through shared caching.
  • Easy to implement global management, such as global logout functionality.
• Disadvantages:
  • Precise management of Tokens in the cache requires further consideration, with complexities in handling expiration and decoupling.
  • The application system has a strong dependency on the SSO server, resulting in relatively lower flexibility.

Authorization Code Method

• Advantages:
  • Provides higher security by exchanging information through a one-time Code, optimizing information transmission and protection against man-in-the-middle attacks.
  • The application system manages user status independently, reducing dependency on the SSO server.
  • Requires fewer modifications to existing application systems, facilitating integration.
• Disadvantages:
  • Complex to implement, requiring additional design for communication flows and depending on the trust and interface approval of the SSO server.
  • Cannot directly implement global logout functionality, requiring additional design support.

Logout Process

Token Method

1. User accesses the logout function of the application system:
   • The application system sends a logout request to the SSO server, providing the user's Token from within the application system.
2. SSO server processes the logout:
   • Deletes the user's login status and other associated Tokens from the cache based on the Token.
3. Application system logout handling:
   • The next time the user accesses other application systems，when the application system sends a Token validation request to the SSO server，it will receive an invalid response because all related Tokens have been deleted in the process.

Authorization Code Method

1. User accesses the logout function of the application system:
   • The application system sends a logout request to the SSO server, providing the user's unique identifier.
2. SSO server processes the logout:
   • Deletes the user's related login status on the SSO server.
   • Notifies all application systems (SP) of the subscribed user-related logout information.
3. Application system logout handling:
   • Upon receiving the notification from the SSO server, the application system deletes the locally stored user-related login status.
   • The user will no longer be able to use the login account for other application systems.

Common Single Sign-On Solutions

Shared Session/Cookie

Achieve single sign-on by sharing a user's authentication Session or Cookie across multiple applications.

Advantages

• Simple to implement, suitable for multiple applications under the same domain or subdomain.
• Good performance, as there is no need for frequent external authentication requests.

Disadvantages

• Cross-domain implementation is complex and may require additional proxies or shared storage.
• Lower security, vulnerable to Session hijacking and XSS attacks.

Applicable Scenarios

Simple applications within the same organization, under the same domain or subdomain.

OAuth

Open Authorization (开放授权协议) protocol, where users grant clients access to resources through an authorization server (typically in the form of an Access Token).

Advantages

• Supports cross-domain and third-party authorization, making it suitable for internet applications.
• Offers rich permission control mechanisms, allowing for fine-grained authorization scope.

Disadvantages

• Primarily used for authorization rather than authentication; implementing SSO requires extensions (e.g., combining with OpenID Connect).
• Security depends on the protection and management of the Token.

Applicable Scenarios

Third-party login and cross-organizational resource access control.

SAML (Security Assertion Markup Language)

An XML-based protocol that uses security assertions to transmit user identity information between an identity provider (IdP) and a service provider (SP).

Advantages

• Widely used in enterprise environments, supporting complex identity management requirements.
• Good cross-platform support, suitable for heterogeneous systems.

Disadvantages

• Complex implementation, relies on XML, with relatively poor performance.
• Cumbersome configuration, less flexible than modern protocols (such as OIDC).

Use Cases

Intra-enterprise and cross-enterprise system integration.

OIDC (OpenID Connect)

An authentication protocol based on OAuth 2.0 that extends OAuth to provide user identity verification and basic profile information retrieval.

Advantages

• Lightweight, based on JSON and REST API.
• Widely supported, suitable for modern web applications and mobile platforms.
• Provides both authentication (ID Token) and authorization (Access Token) capabilities.

Disadvantages

• Requires reliance on the underlying OAuth implementation, which may increase the initial learning curve.
• Less support for older systems compared to SAML.

Applicable Scenarios

Modern web applications, mobile apps, cross-platform single sign-on.

LDAP

Lightweight Directory Access Protocol, used for centralized management of user information and authentication.

Advantages

• Suitable for centralized management of large-scale user directories.
• Can be combined with multiple authentication mechanisms.

Disadvantages

• Primarily a user information management protocol, not a complete Single Sign-On (SSO) solution.
• Requires integration with other protocols (such as Kerberos) to achieve SSO.

Use Cases

Internal enterprise use, for unified management of user directories.

Kerberos

A ticket-based authentication protocol where users obtain tickets from the KDC (Key Distribution Center) to access services.

Advantages

• High security by avoiding password transmission.
• Suitable for complex enterprise networks and distributed systems.

Disadvantages

• Complex deployment, relies on time synchronization.
• Not ideal for high-latency or unstable network environments.

Applicable Scenarios

Within enterprises, in scenarios requiring high security (e.g., banking, government).

Summary Comparison

Use Existing Proven Solutions

Applicable Scenarios

• Rapid Startup: The project requires rapid deployment and is under time pressure.
• Broad Support: Needs to support the integration of a wide variety of applications and services.
• Enterprise-Level Support: Requires enterprise-level technical support and maintenance.

Commercial Solutions

Authing.cn

https://docs.authing.cn/v2/concepts/

Authing is a domestic identity authentication service provider that supports multiple standard authentication protocols (such as OIDC, OAuth 2.0, SAML, LDAP, etc.) and is suitable for application integration across multiple platforms. It not only provides powerful identity authentication functions but also supports user management, permission control, and multi-factor authentication (MFA).

It allows applications from any platform to be connected, supports multiple standard authentication protocols, and offers form auto-fill functionality to facilitate the integration of legacy projects. It supports private deployment.

Advantages

• Relatively comprehensive documentation.
• Provides a low-code integration solution, supporting quick project startup.
• Supports form auto-fill functionality, making it convenient for integrating legacy systems.
• Offers both SaaS and private deployment modes, providing high flexibility.
• Numerous industry cases and mature technology.

Technology Stack

Backend:

• Node.js 14.19.3, Nest.js 6.7.2
• Java8, Java11, Spring-Boot 2.5.15
• Golang 1.21, Gin 1.9.1

Frontend: React.js 16.13.1

Baidu AI Cloud IDaaS

https://cloud.baidu.com/doc/IDaaS/index.html

Baidu AI Cloud Identity Management Service (Identity as a Service, abbreviated as IDaaS) is a service provided by Baidu AI Cloud to address the complex identity management needs of enterprise customers. It offers unified identity, single sign-on, data synchronization, centralized permissions, application management, and more. IDaaS is primarily used to integrate internal enterprise IT systems (e.g., OA) deployed locally or in the cloud, business systems (e.g., ERP, CRM, etc.), or the increasingly prevalent cloud-based SaaS applications.

Advantages

• Simple and Easy to Use: Supports industry-standard identity authentication, single sign-on, and other protocols. Integrating identity systems requires only simple configuration and no additional development.
• Low Cost: IDaaS itself is a SaaS-based cloud service, requiring no separate deployment, implementation, or maintenance. It is ready to use out of the box and can effectively reduce enterprise operational costs.
• Openness: Adhering to an API-first design philosophy, IDaaS provides customers with complete OpenAPI, effectively empowering enterprise customers in building and integrating their identity systems.

SSO360

https://www.sso360.cn/

SSO360 is dedicated to providing enterprises, institutions, and developers with cloud-based identity authentication and governance, dynamic access control, and automated, visual, and traceable permission management. With the concept of digitally connecting everything, it breaks down barriers between people and the digital world, helping to build a one-stop digital security portal, redefining digital security boundaries, and empowering users with identity governance and digital services across all scenarios.

As a leader in integrated zero-trust security in China, Palar Software currently possesses the most complete zero-trust product system domestically. Starting from identity-centric dynamic access control, it has gradually extended to an end-to-end zero-trust security solution integrating endpoint management, SDP, micro-segmentation, dynamic authorization, API gateway, user behavior analysis, data access security, and more. This helps enterprises cope with increasingly complex and changeable internal and external security threats, strengthening end-to-end security protection capabilities. It has successfully provided professional "Integrated Zero-Trust Security" services with an ultimate experience to over 1,400 enterprises and institutions across various industries, including finance, manufacturing, pharmaceuticals, education, retail, government, real estate, and research institutes.

Advantages

• A leader in the domestic integrated zero-trust security field, possessing the most complete zero-trust product system in China.
• Provides identity-centric dynamic access control.
• Product functionality extends to integrated endpoint management, SDP, micro-segmentation, dynamic authorization, API gateway, user behavior analysis, data access security, and more.
• Helps enterprises cope with complex and changeable internal and external security threats, providing end-to-end zero-trust security solutions and strengthening enterprise end-to-end security protection capabilities.
• Provides professional services to over 1,400 enterprises in industries such as finance, manufacturing, pharmaceuticals, education, retail, government, real estate, and research institutes.
• Offers an ultimate experience "Integrated Zero-Trust Security" solution.

Meicloud Unified Authentication Access Management IAM

https://www.meicloud.com/miot/product-detail/461446284550144.html

Unified Authentication Access Management IAM is Meicloud's new-generation identity security authentication product. It integrates single sign-on, unified authentication, dual-source authentication, multi-factor authentication, security against brute force attacks, and intelligent risk control into an identity access control platform.

Advantages

• Simple authentication integration, supporting standard protocols such as CAS, OAuth2, SAML2, OIDC, as well as LTPA mutual trust. It also supports rapid integration of third-party authentication methods like WeChat Work, WeChat, DingTalk, Feishu, etc.
• Provides complete unified authentication interfaces, supporting full-capability authentication for non-Web systems.
• High security, achieved through security against brute force attacks, intelligent risk control, and multi-factor authentication, ensuring high-security authentication.
• Convenient access, supporting dual-source authentication via various methods such as AD, LDAP, and API interfaces.

Application Scenarios

• Single Sign-On Authentication: Integrates downstream B/S business systems to achieve single sign-on authentication and single sign-out for permissions, and provides unified authentication for mobile apps and client products.
• Third-Party Authentication Integration: Supports one-click integration for enterprise WeChat, DingTalk, Feishu, WeChat used by enterprises, and also supports one-click integration with other SSO systems via LTPA mutual trust or standard CAS, OAuth2, OIDC protocols.
• Security Protection: Achieves security management and control for authentication through account and IP security brute-force protection and multi-factor authentication.

Nington

https://www.nington.com/solution-iim/

Through the Nington Unified Identity Platform solution, accounts for user sources, devices, terminals, and networks are consolidated. Users only need one account and password to log in to applications, devices, terminals, and networks.

Advantages

• Strong capability to integrate legacy systems and terminal devices.
• Provides enterprise-level technical support, suitable for application scenarios in traditional industries.
• Supports private deployment, meeting the data compliance requirements of domestic enterprises.

Okta

https://www.okta.com/

Okta is one of the internationally widely used identity authentication and access management platforms, providing enterprises with comprehensive SSO solutions. It supports modern web applications, mobile applications, and cross-platform integration.

Advantages

• Provides rich APIs and developer tools, suitable for complex integration needs.
• Strong multi-factor authentication (MFA) support, including Google Authenticator, YubiKey, etc.
• Primarily cloud-based service, while also supporting private deployment (at an additional cost).
• Provides SLA support, suitable for scenarios with high service quality requirements.

Auth0

https://auth0.com/

Auth0 is an identity authentication and authorization platform focused on developer experience. As a sub-brand of Okta, it inherits rich functionality and flexibility, supporting multiple authentication protocols and integration scenarios.

Advantages

• Rule engine supports high degree of freedom in customizing authentication logic.
• Provides powerful developer tools and extensibility.
• Suitable for modern web application and mobile scenarios.
• Offers various multi-factor authentication (MFA) options to enhance security.

Entrust IDaaS

https://www.entrust.cn/products/iam/identity-as-a-service

Entrust is a leading digital security company dedicated to providing comprehensive identity verification, data encryption, and network security solutions. Its products help enterprises and organizations ensure the security of digital operations in increasingly complex network environments, protecting critical data and user identity information.

Entrust's IDaaS (Identity as a Service) is a cloud-based identity verification and access management solution. It aims to help organizations enhance security and improve user experience by providing simplified identity management capabilities. As a comprehensive solution, it provides trusted identities for employees, consumers, and citizens, enabling them to interact securely with your organization. With intelligent user identity verification, authorization, and access control features, the identity as a service solution enables you to achieve zero trust, promote compliance, and protect sensitive data.

Advantages

• Enterprise-Grade Security: Reduces potential threats in the identity verification process through multi-factor authentication and dynamic risk assessment.
• Ease of Use: Provides a simple user interface and management tools, reducing the workload on IT administrators.
• Global Support: Entrust has years of experience in the identity management field and can provide reliable solutions for different regions and industries.

Open-Source Solutions

Keycloak

Keycloak is a powerful open-source identity and access management solution maintained by the Red Hat community. It supports features like user authentication, user management, single sign-on, and fine-grained access control.

• Supported Protocols: OpenID Connect, OAuth 2.0, SAML 2.0
• Feature Highlights:
  • Provides User Federation capabilities for integration with existing LDAP or Active Directory.
  • Supports Multi-Factor Authentication (MFA).
  • Rich extensibility through custom Service Provider Interfaces (SPIs).
• Advantages:
  • A well-established open-source project, mature and stable.
  • Active community and comprehensive documentation.
  • Offers Docker-based quick deployment options.
  • Supports SDKs for multiple programming languages.
• Use Cases: Enterprise applications, scenarios requiring high customization.
• Official Website: https://www.keycloak.org
• Project Homepage: https://github.com/keycloak/keycloak
• Primary Tech Stack: Java
• GitHub Stars: 24k

Authelia

Authelia is an open-source authentication and access management server designed for modern web applications, supporting two-factor authentication and access policy management.

• Supported Protocols: OpenID Connect, OAuth 2.0
• Feature Highlights:
  • Supports Two-Factor Authentication (2FA).
  • Provides easy-to-deploy Docker images.
  • Flexible policy management for setting access control based on user groups, devices, geographic locations, and other conditions.
  • Functions as an extension for reverse proxy gateways (e.g., NGINX, Traefik) and does not directly connect to the application backend.
• Advantages:
  • Lightweight, with excellent performance and very low resource consumption.
  • Active community and rich documentation.
  • High security, collaborating with reverse proxies to prevent attacks from the network edge and protect application access.
• Use Cases: Small teams, simple identity management requirements.
• Official Website: https://www.authelia.com
• Project Homepage: https://github.com/authelia/authelia
• Primary Tech Stack: Go
• GitHub Stars: 22k

Logto

Logto is a modern open-source authentication and single sign-on (SSO) platform focused on providing simple yet powerful identity management capabilities for modern web and mobile applications.

• Supported Protocols: OIDC, OAuth 2.0, SAML 2.0.
• Feature Highlights:
  • Supports identity management in multi-tenant environments.
  • Provides user management, permission management, and access logging.
  • Offers developer-friendly APIs and SDKs for easy integration into existing applications.
  • Supports SaaS cloud services and on-premises deployment.
• Advantages:
  • Comprehensive documentation and good developer experience.
  • Provides a lightweight Docker deployment method.
  • Offers various out-of-the-box connectors, including integrations with WeChat, Alipay, Tencent Cloud/Alibaba Cloud SMS services, etc.
• Use Cases: Enterprise applications, projects requiring rapid integration of authentication.
• Official Website: https://logto.io/
• Project Homepage: https://github.com/logto-io/logto
• Primary Tech Stack: Node.Js
• GitHub Stars: 9.2k

MaxKey

MaxKey is an open-source single sign-on authentication system developed by the Dromara community, hailed as a leading product in the IAM-IDaaS field. Its name is a homophone for "Marx's Key," symbolizing the ability to unlock complex enterprise security needs.

• Supported Protocols: OAuth 2.x, OpenID Connect, SAML 2.0, JWT, CAS, SCIM.
• Open Source License: Apache-2.0 license
• Feature Highlights:
  • Supports identity management in multi-tenant environments.
  • Provides standardized Identity Management (IDM), Authentication (AM), Single Sign-On (SSO), RBAC permission management, and resource management.
  • Emphasizes performance, security, and ease of use in enterprise scenarios, widely used in industries such as healthcare, finance, government, and manufacturing.
• Advantages:
  • A domestic open-source project, compliant, autonomous, and controllable.
  • Has a Chinese community and provides Chinese documentation.
  • Offers convenient integration with domestic applications, such as social accounts from WeChat, Alipay, QQ, and SMS services from Tencent Cloud/Alibaba Cloud.
• Use Cases: Enterprise users, especially those in industries with high performance and security demands.
• Official Website: https://www.maxkey.top/
• Project Homepage: https://github.com/dromara/MaxKey
• Primary Tech Stack: Java
• GitHub Stars: 1.5k
• Gitee Stars: 7.8k

Gluu Server

Gluu Server is a comprehensive open-source identity management platform designed to support large-scale deployments, suitable for complex enterprise requirements.

• Feature Highlights:
  • Powerful user management and identity federation capabilities.
  • Supports fine-grained permission management and API security.
  • Provides a highly scalable architecture suitable for large-scale user scenarios.
• Advantages:
  • Broad community support, with commercial support options available.
  • Supports on-premises deployment.
• Use Cases: Enterprises requiring large-scale user management and complex identity federation.
• Official Website: https://www.gluu.org/
• Project Homepage: https://github.com/JanssenProject/jans
• Primary Tech Stack: Java
• GitHub Stars: 505

WSO2 Identity Server

WSO2 Identity Server is an open-source identity and access management solution supporting multiple protocols and complex enterprise scenarios.

• Feature Highlights:
  • Supports user self-registration, password recovery, and account management.
  • Provides fine-grained access control and single sign-on.
  • Integrates well with other WSO2 products and supports microservice architectures.
• Advantages:
  • Powerful enterprise-grade features.
  • Active community, with commercial support options available.
• Use Cases: Enterprise applications and distributed systems.
• Official Website: https://wso2.com/identity-server/
• Project Homepage: https://github.com/wso2/product-is
• Primary Tech Stack: Java
• GitHub Stars: 753

Custom Development for Implementing SSO

In some scenarios, existing commercial or open-source solutions may not fully meet project requirements. Choosing to custom-develop an SSO (Single Sign-On) system can offer the greatest flexibility and control.

The image below shows a single sign-on authentication project I developed in 2023. For details, you can refer to this previous article: Discussing a Nearly Abandoned Project and Recent Open-Source Plans

Applicable Scenarios

• Protocol Standardization: The need for authentication and authorization using standardized protocols (e.g., SAML, OAuth 2.0, OpenID Connect).
• Flexibility: The need to customize authentication and permission management workflows for specific business requirements.
• Custom Requirements: The project has complex requirements that existing solutions cannot fully address.
• Control and Security: The need for complete control over every aspect of the system, including security policies and performance optimization.

Core Technology and Implementation

Using SAML (Security Assertion Markup Language)

SAML is an XML-based open standard for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP).

• Features:
  • Supports cross-domain Single Sign-On (SSO).
  • Provides identity federation and fine-grained permission control.
  • Commonly used in enterprise applications and internal system integration.
• Implementation Suggestions:
  • Leverage existing SAML libraries (such as pySAML2 or OneLogin SAML) to simplify development.
  • Configure the trust relationship between the IdP and SP to ensure data security.

Using OAuth 2.0 and OpenID Connect

OAuth 2.0 is an authorization framework, and OpenID Connect is an authentication protocol built on top of OAuth 2.0.

• Features:
  • OAuth 2.0 provides an authorization mechanism, allowing third-party access to resources without exposing user passwords.
  • OpenID Connect adds user authentication functionality, suitable for modern web and mobile applications.
• Implementation Suggestions:
  • Design an authentication server, implementing flows such as Authorization Code and Implicit.
  • Use JWT (JSON Web Token) as a carrier for authentication and authorization data.
  • Accelerate development using open-source libraries (such as Authlib, Openiddict, etc.).

JWT-Based Custom SSO

JWT is a lightweight data exchange format commonly used to implement user authentication and authorization.

• Features:
  • Data is stored in JSON format, supporting cross-language and cross-platform use.
  • The signing mechanism ensures data integrity and trustworthiness.
• Implementation Suggestions:
  • Generate a JWT upon user login, containing user information, permissions, and an expiration time.
  • Pass the JWT between applications, verifying the signature and expiration time to confirm user identity.
  • Use secure signing algorithms (such as HMAC SHA256 or RS256) to ensure security.

Security Considerations

• Multi-Factor Authentication (MFA): Add an additional authentication step to the login process, such as SMS verification codes, one-time passwords, or biometric recognition.
• Attack Defense:
  • Use HTTPS to encrypt data transmission.
  • Prevent replay attacks by including timestamps and unique identifiers.
  • Monitor and record user activities to promptly detect abnormal behavior.
• Logging and Auditing:
  • Implement comprehensive system logging to facilitate troubleshooting and security audits.

Strengths and Weaknesses Analysis

• Advantages:
  • High flexibility, fully meets personalized needs.
  • Performance and user experience can be optimized according to specific scenarios.
  • Security and privacy protection can be fully controlled.
• Disadvantages:
  • High development and maintenance costs.
  • Requires strong technical team support.
  • There are certain development risks.

---

References

• Summary of Self-Built Single Sign-On (SSO) System Solutions - https://flyeric.top/archives/build-sso-system-summary
• Discussion on SSO - https://v2ex.com/t/831596#r_11330208
• After Reading This, You Can No Longer Say You Don't Understand SSO Principles (SSO原理) - https://www.cnblogs.com/qdhxhz/p/17007958.html
• https://blog.itning.top/post/2019/04/08/单点登录sso和集中式认证服务cas和开放授权oauth的简要解释/