title: How to create a Shared Login Service across Multiple Domains?
body: <p>I'm interested in how to implement a shared cross-domain login system as well as best practices and security precautions to take. If you are familiar with 37Signals, you are probably accustomed to their usage of having a shared universal authentication mechanism whereby you do not have to subsequently login if you use the top level navigation to a different product. I would like to implement something in a similar fashion. </p>
  
  <p>The closest thing I've found online is the Wikipedia entry on a <a href="https://secure.wikimedia.org/wikipedia/en/wiki/Central_Authentication_Service" rel="noreferrer">Central Authentication Service</a> and the response to <a href="https://stackoverflow.com/questions/342378/cross-domain-login-how-to-login-a-user-automatically-when-transfered-from-one-d/342498#342498">Cross Domain Login - How to login a user automatically when transfered from one domain to another</a>, which may be slightly different in this case.</p>
  
  <p>I have inspected their session cookies to get a grasp on what they're doing in the process. Initially, each product link has a "goto" uristub, i.e.:</p>
  
  <blockquote>
    <p><a href="https://MY_COMPANY.campfirenow.com/id/users/[int_identifier]/goto" rel="noreferrer">https://MY_COMPANY.campfirenow.com/id/users/[int_identifier]/goto</a></p>
  </blockquote>
  
  <p>Using FireCookie and the NET tab in Firebug, I'm able to see the cookies that are set and the redirects that occur in the process. The <code>goto</code> url fires a 302 redirect to:</p>
  
  <blockquote>
    <p><a href="https://MY_COMPANY.basecamphq.com/login/authenticate?sig=[BASE64_ENCODED_AND_ENCRYPTED_DATA]" rel="noreferrer">https://MY_COMPANY.basecamphq.com/login/authenticate?sig=[BASE64_ENCODED_AND_ENCRYPTED_DATA]</a></p>
  </blockquote>
  
  <p>The session identifier is recreated, most likely for CSRF purposes. Some of the data in the cookies as well as the GET parameter sig were partially decrypted using base64_decode to the following:</p>
  
  <pre><code>// sig GET param
  array(2) {
    [0]=&gt;
  ���ף�:@marshal_with_utc_coercionT7�z��&lt;k��kW"
    [1]=&gt;
    string(18) "���k�&lt;kn8�f���to��"
  }
  
  // _basecamp_session cookie session param
  string(247) {
  :_csrf_token"1Sj5D6jCwJKIxkZ6oroy7o/mYUqr4R5Ca34cOPNigqkw=:session_id"%060c0804a5d06dafd1c5b3349815d863"
  flashIC:'ActionController::Flash::FlashHash{:
  @used{: auth{"
                MY_COMPANY{:
                         user_idi�3
  :identity_idi�W����������s�]��:�N[��:
  </code></pre>
  
  <p>߾�����"</p>
  
  <p>The encoding is breaking the code block. Thanks for your help!</p>