I'm working on a security concept of a bigger project. It will be done with Spring,but that's actually not relevant right now.
The whole system is a hierarchical tree of computer nodes that run a custom platfrom software, whereas layer 1 nodes connect to a node on layer 2, layer 2 nodes connect to a node on layer 3 and so on.
The idea is that the whole system has a master node which will be the root of the tree. The whole user management including authentication will be done there. Meaning a login request from a lower layer node will be forwarded to the root node. The concept for this is pretty much done and looks good.
The difficult part right now is the authorization. The system should give a top down SingleSignOn feeling. Meaning if I've signed on on a layer 3 node, I will not have to sign on on any lower layer node again. Currently I imagine it like this:
Sign on
- User signs on on an upper node
- User gets the session key stored in a cookie
- User access a platform on a lower node
- Lower node's authorization module does not know the session key provided
- Authorization module ask upper node if session key is known
- An upper node instance knows session key and responses with an OK
- Authorization module on the node with attempted access creates a new local session for this user.
- Session key gets added to cookie.
- User uses local session key for further access of this node.
Sign off
- User signs off on a random node
- Node on which the user signed off informs the node with the stored original session key, that the session is not valid any more.
- The node with the stored session original session key send a broadcast down to inform all clients that this session is now invalid.
The whole inter layer communication will be secured of course.
This concept would technically work, I guess. As I never had to create a complex security concept like this, I really d'like to hear another opinion. Maybe I'm overseeing a major issue. Can you see a fatal hole in the story, or should I go with that?
UPDATE
An important detail I missed, is that a lower layer does not necessarily have direct network access to the top layer. It can happen that the layers are in different networks and only will have direct network connection to next higher layer. Therefore I will not have the possibility to make a central login server as usually used with SSO.
UPDATE
Sequence diagram explaining the whole process and need of keys