Implement Single Sign-On on Rich Client (Offline)?

Question

In our company, we have several rich Java applications that are used both by internal users and external users. We would like to start migrating these systems to support a single sign mechanism and potentially allow our external clients to use their own authentication mechanisms to validate their users.

For example, if we have a client that has a large number of users, and they would like their users to register only with information about their company, we would like to support this behavior.

We examined the use of certificate-based authentication systems (one of the most common is Kerberos) and the use of this authentication mechanism, which allows using external authentication services in our system.

Is this doable? Are there specific implementation details that we need to know about? I'm not interested in specific technologies (although suggestions are certainly welcome), more about key concepts and ensuring that we do the right thing when possible.

How about authorization, i.e. access to various services. Is there a standard or best practice for how this is handled when working with potentially disabled authentication services?

As an additional note, our front-end systems are created in Java, therefore, certain information related to the implementation of this behavior in the Java structure is certainly appreciated (that is, libraries that are useful, potential traps specific to Java, etc.).

Answer 1

Is this doable? Yes.
Are there specific implementation details that we need to know about? Yes.

Each type of security implementation has its own implementation details that you just need to find out. Each of them is different and has its own nuances.

You should be able to implement any type of security that you have chosen. Kerberos is a great choice. You can also watch Openid and CAS. However, there are many others.

To handle actual security, you might consider using Spring Security. Spring Security is able to correctly handle authentication / authorization. However, most of Spring’s security is really focused on security on the Internet, and not on client systems, so you will most likely have to implement many authentication mechanisms yourself (using libraries, accessible libraries, when possible, of course).

When designing your system, especially if you will have many different types of login types, try to create a login system that is as flexible as possible. This will take time and a lot of trial and error.

I would take a look at Spring Security 3 book. This is not a great book, but it explains a lot about how to properly implement security. The use of service springs is highly recommended, because trying to implement safety in itself will be quite a challenge.

The best happiness.