Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance related things in. Some of these systems provide web services to get the necessary information, so proper user authentication and whatsoever is possible. However, some provide direct database access without anything which comes even close to user authentication, because it was not designed to do that.
To solve this issue we are building an adapter-service, which can connect to all the different systems to get the necessary data. However the user-authentication is still an issue for the systems which don't provide that.
Another software engineer suggested (we are the only engineers) we build a general authentication mechanism which provides authentication to all the systems to get the necessary customer information. We both have the same background, we are young, we don't have that much experience in designing such a system or understanding all the security issues for such a system.
Question: With the background as stated above, I am concerned about all the security concerns which may come up if we would do that. That for the serious kind of information (insurance data) we may lack the experience to set up a system like that, to ensure the best kind of security is possible and not limited by our knowledge (or Google).
- His opinion on this matter is that a general authentication mechanism should be build for all systems. So with one login on our side they can get all the data from the different systems if it is available there. If we follow up with things such as OAuth that we don't have to fear the security issue that much. And if we (re)search these things on the internet, that it will be OK.
- My opinion on this matter is that a general authentication mechanism will be a good thing for all the systems which don't provide the necessarry things for user authentication (which is also possible the only solution). However we should not override systems which provide their own authentication to access their system to get the necessary data from a customer. Perhaps information can be exchanged between all the systems to ensure the same kind of login is available everywhere (if user exists in a system which provides authentication and with a systems which uses the general authentication). If an password for example is changed. This idea would make sure if our general authentication mechanism is breached somehow, that not all the systems will be exposed to the attacker, and who knows what the consequences might be.
Should we just go through with the idea to make a general authentication mechanism or limit it to the systems who need it and possible exchange login-details if the user should exist in the two different kind of systems (system which supports authentication or doesn't). What are good arguments for or against these ideas?
Edit: The general public would be using it, each system would provide the contract(s) with its data (if the customer exists in the different systems). Example: for customer '1' system A (database) and B (web-service) contains both different contracts from him. However, for customer '2' only system A (database) contains a contract. Depending on the customer their kind of contract(s) they are stored in different systems. All of these systems are third party.