An Improved Single Sign-On Mechanism by Enhancing the Functionality of Reverse Proxy

Abstract

With growing number of applications, and each user having different passwords for different applications, an improved single sign on design, which can address proper credentials management, dynamic session management, reduce background overload and solve security loop holes, is required. The above features can be easily implemented by enhancing the functionality of reverse proxy David et al. (A framework for secure single sign-on), (http://www.authenticationworld.com/Single-Sign-On-Authentication/SSOandLDAP.html). When a user successfully logs into primary server for the first time, his user ID and session ID are cached at the proxy. Next time onwards, when the user tries to access other applications, a dynamically generated login page, which contains an AJAX routine, is sent to the client’s browser by the reverse proxy. The client’s browser on loading the page executes the AJAX routine which retrieves login information of that cached user from an authentication service and completes the login process with the backend server. In case of logout, the reverse proxy dynamically sends logout request to all the logged in applications. This implementation of single sign on can reduce background overload by shifting the entire SSO logic on client side. Moreover, this approach is more secure than classical Agent based Single Sign-On approach because clients cannot directly access the application server.