0

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with said credentials on different websites (Moodle, Outlook, MSDNAA and some others that use the same data) whenever they want to access them.

What would be a good, safe way to store this information for use in this manner? Or do I have to try to use a different authentication method for each and every individual website?

2

In general an official standard is OpenIDConnect. It allows to create an id_token after the user has logged in. The applications or websites to which the user should be logged in afterwards has to trust the identity provider to accept the generated token.

Example: Sometimes you can see a possibility, where you can login into the google website and where you can use the another service or website afterwards. But the other service provider needs to implement a trusted connection to google authentication and the user needs an account that is managed by google. So some amount of cooperation between authentication providers and service providers is prerequisite.

If you want to create an identity provider, that can manage logins of your users, you can use for example keycloak. It can save user credentials or connect to other user databases like ldap. But other public service providers will probably not trust your authorization server. You can only use it to be logged in to your own several services.

Or you can choose a partner like google where your users have to make an account and you implement a verification for the login status provided by google. Or maybe you can find another identity provider that fits better to the webservices you want to be logged in to.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.