Re^3: Single Sign-On?

Just so I understand you correctly, you're suggesting having x-odd buttons on every sites' main page, each one saying "log me in with my perlmonks account", "log me in with my CPAN account", "log me in with my foobar account"? This is MS Passport, except that instead of a one-to-many relationship, you have a many-to-many relationship. Also, it would probably require a major infrastructure change so that external sites can try to authenticate against your login credentials.

thor

Feel the white light, the light within Be your own disciple, fan the sparks of will For all of us waiting, your kingdom will come

Comment on Re^3: Single Sign-On?

Replies are listed 'Best First'.
Re^4: Single Sign-On? by jhourcle (Prior) on Mar 06, 2005 at 16:56 UTC
In that sort of a situation, you wouldn't use a seperate button for each one -- you'd have some way in the login id to specify if it were a remote id. Most rent-a-POPs use this. (The companies that rent out modem banks, so that other ISPs can claim to have 'nationwide' coverage). If you have to log in as `user@domain` or `user/domain` you've probably gone through one of these -- when the radius server that you're authenticating off of see the domain, it checks to see if it's a domain that it knows about, and if it is, it uses whatever authentication check is necessary to authenticate in that domain. So, I might log in as `ONEIROS@PAUSE` or `oneiros@perl.org` or `jhourcle/perlmonks` or `whatever_my_local_userid_is_without_a_domain` or however the system handled things. You're right, however, in that there is n*(n-1) complexity for the system administrator, as each of the n sysadmins needs to know how to authenticate to n-1 other systems -- but it doesn't require a seperate login blank for each one, or a button for each one.	[reply] [d/l] [select]

Replies are listed 'Best First'.

Re^4: Single Sign-On?
by jhourcle (Prior) on Mar 06, 2005 at 16:56 UTC

In that sort of a situation, you wouldn't use a seperate button for each one -- you'd have some way in the login id to specify if it were a remote id. Most rent-a-POPs use this. (The companies that rent out modem banks, so that other ISPs can claim to have 'nationwide' coverage).

If you have to log in as user@domain or user/domain you've probably gone through one of these -- when the radius server that you're authenticating off of see the domain, it checks to see if it's a domain that it knows about, and if it is, it uses whatever authentication check is necessary to authenticate in that domain.

So, I might log in as ONEIROS@PAUSE or oneiros@perl.org or jhourcle/perlmonks or whatever_my_local_userid_is_without_a_domain or however the system handled things.

You're right, however, in that there is n*(n-1) complexity for the system administrator, as each of the n sysadmins needs to know how to authenticate to n-1 other systems -- but it doesn't require a seperate login blank for each one, or a button for each one.

[reply]
[d/l]
[select]