What is the principle of implementing single sign-on in php

The principle of PHP to implement single sign-on is: first store the trust in the client's cookie; then further verify the cookie. In order to efficiently store a large amount of temporary trust data, a distributed cache solution similar to memcached can be used.

Single Sign On SSO (Single Sign On) simply means that in an environment where multiple systems coexist, after users log in at one place, they do not need to Logging in in other systems means that the user's one login can be trusted by all other systems.

(Related recommendations:php training)

Single sign-on is used very frequently in large websites, such as websites like Alibaba. Behind the website is There are hundreds or thousands of subsystems, and a user's operation or transaction may involve the collaboration of dozens of subsystems;

If each subsystem requires user authentication, not only will the user go crazy, but each subsystem will also This logic of repeated authentication and authorization is crazy.

In the final analysis, implementing single sign-on is to solve how to generate and store that trust, and then how other systems verify the validity of this trust;

So the key points are as follows:

1. Storage trust

2. Verification trust

As long as the above problems are solved and the effects mentioned at the beginning are achieved, it can be said to be SSO.

The simplest way to implement SSO is to use Cookie. The implementation process is as follows:

It is not difficult to find that the above solution stores trust on the client. In Cookie, although this method is easy to implement, it will immediately make people question two issues:

1. Cookies are not safe

2. Cross-domain login is not allowed

For The first problem is usually solved by encrypting cookies. The second problem is a flaw. In fact, the idea of this solution is to store the trust relationship on the client. To achieve this, you do not necessarily have to use cookies. Flash can also be used to solve this problem. Flash's Shared Object API provides storage capabilities.

Generally speaking, large systems will adopt the method of storing trust relationships on the server side. The implementation process is as follows:

The above solution is to store trust relationships on the server side. The relationship is stored in a separate SSO system (let's call it that for the time being). It is simply moved from the client to the server, but several problems need to be solved:

1. How to efficiently store a large number of temporary Sexual trust data

2. How to prevent the information transfer process from being tampered

3. How to make the SSO system trust the login system and the non-login system

For the first question, Generally, a distributed cache solution similar to memcached can be used, which can not only provide a mechanism for scalable data volume, but also provide efficient access.

For the second question, the digital signature method is generally adopted, either through digital certificate signing or through a method like md5. This requires the SSO system to perform md5 on the parameters that need to be verified when returning the login URL. Encrypt and return with the token;

When the system that needs to be logged in finally verifies the trust relationship, the token needs to be passed to the SSO system. The SSO system can identify whether the information has been authenticated by verifying the token. Changed.

For the last problem, it can be solved through the whitelist. To put it simply, only the systems on the whitelist can request the production trust relationship. Similarly, only the systems on the whitelist can be exempted from login.

The above is the detailed content of What is the principle of implementing single sign-on in php. For more information, please follow other related articles on the PHP Chinese website!