diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 8 |
1 files changed, 4 insertions, 4 deletions
@@ -11,7 +11,7 @@ I’ve written a simple single sign-on solution (400 lines of code), which w Let’s start with a website that doesn’t have SSO. -[](/wp-content/uploads/sso-diagram_no-sso.png) +[](http://www.jasny.net/wp-content/uploads/sso-diagram_no-sso.png) The client requests the index page. The page requires that the visitor is logged in. The server creates a new session and sends redirect to the login page. After the visitor has logged in, it displays the index page. @@ -29,7 +29,7 @@ The broker will talk to the server in name of the client. For that we want the b [-> Try it! (jan/jan1)<-](http://sso-alex.jasny.net) -[](/wp-content/uploads/sso-diagram_alex.png) +[](http://www.jasny.net/wp-content/uploads/sso-diagram_alex.png) When you visit a broker website, it will check to see if a token cookie already exists. It it doesn’t it, the broker sends a redirect to the server, giving the command to attach sessions and specifying the broker identity, a random token and the originally requested URL. It saves the token in a cookie. @@ -43,7 +43,7 @@ The client logs in, sending the username and password to the broker. The broker [-> Try it! <-](http://sso-binck.dutchc5.net) -[](/wp-content/uploads/sso-diagram_binck.png) +[](http://www.jasny.net/wp-content/uploads/sso-diagram_binck.png) You visit another broker. It also checks for a token cookie. Since each broker is on their own domain, they have different cookies, so no token cookie will be found. The broker will redirect to the server attach to the user session. @@ -59,7 +59,7 @@ SSO and AJAX / RIA applications often don’t go well together. With this ty With this solution the client only needs to attach the session by providing the server with a token generated by the broker. That attach request doesn’t return any information. After attaching the client doesn’t talk at all to the server any more. Authentication can be done as normal. -[](/wp-content/uploads/sso-diagram_ajax.png) +[](http://www.jasny.net/wp-content/uploads/sso-diagram_ajax.png) The client check for the token cookie. It it doesn’t exists, he requests the attach URL from the broker. This attach url includes the broker name and the token, but not a original request URL. The client will open the received url in an <img> and wait until the image is loaded. |