SSO between multiple Flex applications [closed]

Question

We have three applications developed in Flex and all these use BlazeDS. These applications have their own authentication implementations (Database). Also they will be deployed in tomcat. Deploying all these applications in the same tomcat instance is acceptable for us.

We want to bring the authentication credentials of all these applications into a single place and also provide SSO feature between these applications. We also want the authentication module to be configurable. Something like the system administrator can decide if the authentication should be done against a database or LDAP.

Say, if the user successfully logs into app1, and when he access app2 in the same browser he should be automatically logged in. Same goes for logout as well.

We have been exploring OpenAM, jGuard and JOSSO. I'm not sure if these require lot of customization to work with Flex. I would like to know how people are implementing SSO for Flex applications.

Is there a common and simple SSO solution available for Flex based applications ?

Answer 1

We had a Flex app with a tcServer(tomcat)/Spring app using BlazeDS. We were using SiteMinder as our SSO, and Spring Security to handle the security. Everything was done on the server-side using Spring Security annotations. The basics of SSO with Spring Security is to use a preauth filter, which uses the SiteMinder headers to lookup the user, and then let Spring Security wire together the roles and handle authorization. Once everything was setup, it was extremely easy to use. SiteMinder handled the login process, and secured the URL. The UI code didn't have to change at all, save for removing the login screens since SiteMinder handled that for us.

Not sure if OpenAM, jGuard, or JOSSO work in a similar fashion, but if you are using Spring in your backend, or are thinking about it, I would recommend using Spring Security and letting it handle everything.