CODEWITHSUNDEEP
pythondjangosingle-sign-ondjango-sites
Adam
Adam

Reputation: 181

Single sign on multiple django sites


I am working in a django development with 3 sites (siteA, siteB, siteC) under single django code base, where every site have his own domain and own database. Because of the separate databases i have separate users for each site.

My question is: is there any possibility to create a Single Sign On to this 3 sites?? And if a user is registered in the siteA and siteB but not in the siteC, in this case, if the user make login in the SiteA will be automatically logged in the siteB (because it is registered in both) but not in the siteC. (like stackexchange.com)

Any suggestion and help is appreciated!
Thank you!

Upvotes: 1

Views: 1083

Answers (1)

User007
User007

Reputation: 1559

The ultimate solution is: OAuth

But if you prefer a short cut, while integrating OAuth into all these Django sites, you can:

Site A: Ken, John

Site B: Ken, Joh

Site C: John

We have two sites, and the main sites using some resources from site B but it must be a user on site B. But the two websites do not sync users. Because OAuth was a painful integration, we are doing this:

1. Ken login through Site A.
2. As soon as he hits "login", he's redirected to login to Site B and C through iframe login (submit the auth login requests through HTTPS).

3. The iframe login will return cookies of the site trying to login
     - site B
     - site C
4. Since Ken is not a user of Site C, there is no cookies return from Site C.
5. After two iframe logins, you are back to Site A and at this moment, as authenticated user of Site A, ken has at most two cookies:
    - site A
    - site B

This is a shortcut but highly insecure. When I say iframe login, I am not saying you will see a iframe with the login form. The request is sent off through request.

It is insecure because the users have to same the same encrypted password :/ and passing cookies around is very easy to attack.

Upvotes: 3

Related Questions