How to Implement SSO on existing tomcat web application

Question

I have a tomcat 7 setup with oldApp.war and newApp.war deployed on it. Both the applications share the same login credentials for users on the database.

I can access the apps using https://localhost/oldApp and https:localhost/newApp respectively.

My oldApp is a Spring MVC java application and when the user is logged into the oldApp I want to have a link which will take the user into the newApp without asking for the login credentials.

I want to know how to implement SSO to do this. I preferably don't want to run any external service to handle this.

Thanks in advance.

Answer 1

Update: Its 2018 and the below info is out of date. If you’re starting a new application then use a federated identity protocol like Open ID Connect and you’ll get SSO for free.

There are a few approaches you could take:

1. You could use Tomcat for authentication and use Tomcat's single sign on capabilities. If you're currently using Spring to authenticate the user you may need to change some things. Also, depending on how you're doing authentication, Tomcat's authentication may not be configurable enough.
2. You could setup a third, CAS, servlet (or something similar), which both web applications authenticate against.
3. You could set this up yourself using Spring and pre-authenticated filters. You would basically have to write your own pre-authenticated filter which checked some location that both servlets had access to (database?, shared context?) for existing credentials before falling back to old authentication methods. You'll want to make sure to clear this authentication in a filter somewhere so the next request doesn't get to automatically inherit the previous requests credentials.

Answer 2

You can implement SSO in many different ways:

1. Oauth 2 - http://oauth.net/2/
2. SAML 2 - https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security

SAML 2.0 has many implementations for Identity/Service provider roles.

For an IDP implementations list I can point you to this stackoverflow post: https://stackoverflow.com/a/761774/126414

If you are planning to implement a service provider there is a nice spring extension: http://static.springsource.org/spring-security/site/extensions/saml/index.html