{"repo":"guardian/pan-domain-authentication","free":true,"listed":false,"github":"https://github.com/guardian/pan-domain-authentication","clone":"git clone https://github.com/guardian/pan-domain-authentication.git","description":"Helper to provide a common federated authentication for all services within a domain (AKA Panda 🐼)","language":"Scala","stars":11,"topics":["production","authentication","oauth2","pan-domain-authentication"],"license":"Apache-2.0","category":"auth-billing-email","readme_excerpt":"Pan Domain Authentication This repo - General docs & Scala implementation pan-domain-node - Typescript implementation Pan domain authentication provides distributed authentication for multiple webapps running in the same domain. Each application can authenticate users against an OAuth provider and store the authentication information in a common cookie. Each application can read this cookie and check if the user is allowed in the specific application and allow access accordingly. This means that users are only prompted to provide authentication credentials once across the domain and any inter-app interactions (e.g javascript cross-origin requests) can be easily secured. How it works The library can be used in two ways: - Verify : read the Panda cookie and check whether the user is valid for the request - Issue : as above but redirecting the user to the OAuth provider to authenticate if the cookie is not present or expired Simply verifying the cookie is useful for APIs that cannot provide a user-facing OAuth dance to acquire credentials. It is also useful to minimise the parts of your application that have to have knowledge of the private key. To ensure the cookie is not tampered with, public/private key pair encryption is used. An issuing application signs the cookie using the private key and both verifying and issuing applications verify using the public key. The cookie contains an expiry time generated at issue after which the user should be redirected to the OAuth provided","default_branch":null,"files":null,"tree":[],"storefront":"/r/guardian","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/guardian/pan-domain-authentication/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}