Question

I’ve got a network of websites that I want to create single sign-on functionality for, so that if someone signs up on Site A, they can sign-in to Site B (both owned by me) without creating a new account. I don’t want to use a 3rd party provider like FB or Twitter, I want to be the identity provider for my users.

Is OAuth the right choice for this, or is there an easier/more effective way of accomplishing this? Am I even looking at this the right way? The only authentication experience I’ve got is basic session storage on a single server. Are there any good articles that help explain how I would go about setting up something like this (most of the information I’ve found is about how to do OAuth with FB/Twitter)?

In my specific case, the site that would be the provider is written in Node.js, and the other sites vary in language, but general answers that can benefit anyone are helpful.

Answer 1

You can implement your own OAuth Service Provider that takes place of FB or Twitter and can act as a central server providing your network of websites with single sign-on functionality. To authenticate a user on any of your websites, you initiate the OAuth authentication process, and upon receiving the verifier code on the callback url, you can consider the user logged in (not sure if this is true in oauth-2 too). Of course the prerequisite of this is that all users should be already registered on the service provider site. You may choose to do all the process of registering and authenticating users on the provider site seamlessly via an iframe (if you don’t want to open a popup).