SSO Proxy for Legacy Web Application Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Legacy web applications that do not support contemporary user authentication techniques like SAML or OAuth require users to sign on separately, leading to security vulnerabilities and burdensome credential management.
Innovation Solution
Implementing a secure Single Sign On (SSO) proxy that intercepts login requests and enforces SAML or OAuth authentication for legacy applications without modifying them, using a master password stored in a secure key vault and an SSO identity provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If legacy applications are used without modification, then application compatibility is maintained, but security vulnerabilities increase due to lack of SSO support
Solution Approach 1:
An SSO proxy is introduced as an intermediary component between the legacy application and the user/browser. The proxy intercepts authentication requests, translates them into SAML/OAuth protocols, and communicates with the identity provider. This mediator enables SSO capability in legacy applications without modifying the application itself, resolving the contradiction between maintaining compatibility and achieving security improvement.
2Reliability
If SSO proxy is introduced for legacy applications, then authentication security is improved, but system complexity increases
Solution Approach 1:
The authentication system is segmented into distinct functional components: the SSO proxy handles protocol translation and communication with the identity provider, while the legacy application maintains its original authentication logic. This segmentation allows the complex SSO functionality to be isolated in a separate module, improving security without burdening the legacy application with complexity.
3Ease of operation
If users manage credentials for multiple applications, then application access is achieved, but user burden and security risks increase
Solution Approach 1:
The SSO proxy implements universal authentication by accepting SAML/OAuth tokens from the identity provider and translating them into credentials compatible with multiple legacy applications. This multi-functional approach allows a single authentication mechanism to serve multiple applications, eliminating the need for users to manage separate credentials for each application while maintaining security through centralized authentication.
Data Source
AI summary
A secure single sign on is extended to a legacy web application that does not support the specific user authentication technique being used, such as SAML or OAuth. A proxy intercepts a request by a client computer to access the legacy application, and forwards the intercepted request to a single sign on identity provider. The identity provider authenticates the user, using the specific authentication technique not supported by the legacy application, and provides an indication of success to the proxy. The proxy transmits a user id and master password wrapped in an HTTP request to the legacy web application, which authenticates the request, creates a session and provides corresponding cookies to the proxy. The proxy forwards the cookies to the client, which utilizes them to continue the session with the legacy application.