Hi Michelle,

There are systems that allow you to authenticate a user, set a cryptographic 
session cookie on the client browser and subsequently use that token to 
authenticate the client sending the HTTP request. These systems also allow you 
to define access control rules that depend on the user profile, insert HTTP 
headers into an authenticated request forwarded to the application backend etc.

They generally consist of an Apache module for collecting credentials, setting 
authentication ticket and enforcing the security policies, and some kind of 
centralised AAA server for taking access control decisions. Various 
authentication schemes are provided out of the box, including plain password, 
challenge-response, X.509, SAML...

Sun and CA both offer such systems. I am sure there are others around.

There are several open implementations of SSO that can be used with Apache. I 
have not used any of them. Here's a link listing at least some of them: 
http://www.cesnet.cz/doc/techzpravy/2006/web-sso/

You may also be interested in 
https://opensso.dev.java.net/public/use/docs/pdf/index.html

-ascs
 
-----Message d'origine-----
De : Michelle Konzack [mailto:[EMAIL PROTECTED] 
Envoyé : mardi 25 septembre 2007 14:19
À : apache en
Objet : [EMAIL PROTECTED] One-Time authentificaton for multiple servers

Hello,

I have a couple of servers (currently 42 Web-Servers et a redunant PostgreSQL 
for AUTH) and I am trying to get a One-Time authentification running.

Exactly:

It should not mather on which Web-Server the $USER authenticate and if she/he 
change the website dynamicly...  The AUTH should be done on the PostgreSQL and 
then the Web-Server should ask the PostgreSQL whether the AUTH is valid or not.

I need a variable timeout (per $USER) and it should be refreshed each time the 
user klick a link or such...  After the timeout, the $USER need to 
re-authenticate again on one of the Web-Servers.

In general, I prefer to use PAM auth because the infrastructure is there and 
more easier on Debian-Systems.

Can anyone tell me how to do this?

Note:  I will have over 700.000 $USER if the whole thing is running and 
       we will use at least 200 Web-Servers and 8 PostgreSQL world wide.

Thanks, Greetings and nice Day
    Michelle Konzack
    Systemadministrator
    Tamay Dogan Network
    Debian GNU/Linux Consultant


--
Linux-User #280138 with the Linux Counter, http://counter.li.org/ 
##################### Debian GNU/Linux Consultant #####################
Michelle Konzack   Apt. 917                  ICQ #328449886
                   50, rue de Soultz         MSN LinuxMichi
0033/6/61925193    67100 Strasbourg/France   IRC #Debian (irc.icq.com)

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: [EMAIL PROTECTED]
   "   from the digest: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to