CODEWITHSUNDEEP
javaauthenticationservletsform-authentication
Gautam Kumar
Gautam Kumar

Reputation: 983

Single sign on for multiple web applications in Java

I have multiple web applications with angularjs in the frontend and servlets in the backend. Requests are made using ajax call. Servlets then initializes java objects which fetches data using JDBC connection and returns the result.

  1. How can I implement single sign on for multiple applications?
  2. Do I need to add authentication code to existing projects or shall I implement separate project for authentication and use it across application?

Upvotes: 2

Views: 1654

Answers (1)

Les Hazlewood
Les Hazlewood

Reputation: 19547

Just curious, have you seen the Stormpath Java SDK? There is also a feature called ID Site that gives you a single login location for the apps you build (if you want to use it - it's optional).

A Stormpath Java SDK update will be released shortly that automates this even further for servlet-based web apps, including token authentication via OAuth 2. For example:

  1. User enters username/password in your AngularJS login panel.
  2. The username/password is sent to your Java webapp that has the Stormpath SDK inside it.
  3. The SDK authenticates the user and returns a secure identity token (which is actually a JWT) in the response body or cookie (or both).
  4. Your Angular app takes that token and sends it on all future requests to your web app.
  5. The SDK authenticates the token and looks up the corresponding user account.
  6. The user account is attached to the ServletRequest for access any time during the request's processing (for example, Account account = request.getAttribute("account");

No server-side coding required to enable this :)

If you want early access to try this out, here is the branch: https://github.com/stormpath/stormpath-sdk-java/tree/servlet-module

And a sample application showing how to enable it: https://github.com/stormpath/stormpath-sdk-java/tree/servlet-module/examples/servlet

The SDK is 100% open source via the business-friendly Apache 2 license.

Disclosure: I'm Stormpath's CTO, but also an open-source security advocate - whether you use Stormpath or not, I'd like to see that everyone can easily secure apps.

Upvotes: 2

Related Questions