Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have three different websites that I run on three distinct top level domains. I would like to be able to have users log into any one of them and then be automatically logged into all three. As an additional requirement I'd like the user to be able to use my own login system or a third party system of their choice (eg. Facebook).

Can anyone point me to clear documentation on a "standard" way to do this? Everything I've read suggests trying to write my own solution would be a bad idea. SAML seems to one possible direction to go, so I tried playing with SimpleSamlPhp, but I haven't been able to wrap my head around that (better examples than what they have in their documentation might help).

So what is the best way to accomplish this?

share|improve this question
    
Do you use content management systems on these sites? Since if you do you should be able to do this though clever SQL sharing and cookies saved logins. Similar to how Google logs you in all to all sites using a cookie. –  bybe Mar 5 '13 at 19:04
    
We can certainly share our db between sites, but my question is what is the proper way to do what google does when you log in to all their services. –  matthew Mar 6 '13 at 22:52
    
I'd imagine there would be a way to share the user name profiles within the DB and then set the Cookies to work on 3 sites, take a look at one of the cookies your site uses and see if you can adjust it so it works on 3 sites. It's not my strongest field this but it should be possible. –  bybe Mar 6 '13 at 22:57
    
Think I found what your looking for check my answer in 2mins time –  bybe Mar 6 '13 at 22:59
add comment

4 Answers

I would suggest using Open Id for single sign on. It is the most widely supported.

Users can log in with their Google or Yahoo accounts. This page has a list of some of the biggest account providers for open id. You can also create your own Open ID provider the way that StackExchange does.

There are two drawbacks to it:

  • Facebook doesn't support it. If you want to let users log in through facebook too, you'll need to also implement facebook single sign on.
  • You can't automatically log the users into your three sites. Your users will have to approve each site separately. The approval only needs to be done once per site. Once they have approved the login per site, you can redirect them to the login page and it will bounce them right back with credentials. This is the same as the StackExchange sites work, where you have a single login, but you have to approve each stack site separately.

I limit users logging into my site to only using their Google account. I've found that fewer users get turned off by having to log in with Google than get turned off by the choice paralysis when presented by options. Have a single login link on my page that just takes them to Google makes the login flow much simpler and easier for my users.

share|improve this answer
    
Your second drawback is exactly what I would like to avoid. I could see our users getting confused/annoyed at the extra step (even though it's only once). –  matthew Mar 5 '13 at 18:10
    
It would be theoretically possible to create an open id provider that does not require that confirmation step for your specific three sites. I have not been able to find one with this feature though. –  Stephen Ostermiller Mar 5 '13 at 18:20
add comment

Another way of setting up SSO is to use something like Central Authentication Service, originally from Yale.

This can allow automatically signing in to a site without an authorisation step at each site; your users would sign into the CAS server once, and be authenticated on all sites when they visit them.

There are pre-written modules for most languages, and several content management systems can use CAS for SSO.

share|improve this answer
add comment

A friend of mine started a company called CryptoKey which is taking the approach of generating personal security certificates for user that can be installed into most web browsers. I tested it, and it does not require the confirmation step to let a website see and verify your identity. So after installing their authentication, users would just be logged into all of your sites.

The drawback to this system is that it is much harder for users to get their certificate installed, than it is for them to just create a password.

share|improve this answer
add comment

You should be able to share Logins across multiple domains by:

  1. Sharing the Database (User Details Only)
  2. Sharing Cookies

To do it this way it requires a lot of coding and far to much variables to give you an exact use this code but you should be able to do some little research on Sharing Cookies Cross Multiple Domains hosted on Different Servers. There's actually lot of sites with detailed information how this can be achieved which seems your best route if you want to avoid confirmations etc.

share|improve this answer
    
Using sub-domains of the same root domain would make this easy, but alas my requirements include using completely separate domains. –  matthew Mar 7 '13 at 0:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.