Distributed authentication system (different domains, separatate databases)

Question

We got multiple small websites (microsites) and one main high traffic one with big users base. Right now the requirement is to build authentication system which should allow users to loign with the same identity across the network.

All website are running on different domains, powered by Drupal 6 CMS and have separate databases (so sharing tables with prefix is not an option + it creates a huge mess in the db).

Here is the set of core requirements I came up with:

1. Users should be able to login with the same credentials to all sites within the network
2. User’s data sharing between Main site (storage) and all micro sites within the network
3. Data synchronization across the network when user changes the data (update email or password for example)
4. The login/registration process should be seamless and consistent
5. Register on any of the sites across the network and use that identity to login later on.

In the future there might be a need to add openid authentication options.

Basically we are looking at something similar stackexchange does, but not sure if they have central users base on not.

I was thinking about custom solution which will include 2 parts (modules), one will be stored on the Main site for users data storing and responding to requests from clients. Second part (module) will be placed on each microsite, which is going to send requests to the Master. Some kind of client - server setup.

One of the complications I see right away is #3. Data Synhcronization across the network.

I just don't want to reinvent the wheel and maybe some work is already done in this direction.

Looking forward to your ideas on how to approach this project.

EDIT:

Recently I've found couple related threads on the topic:

http://groups.drupal.org/node/24916
http://drupal.org/node/744400

Answer 1

This might be overkill, but have you considered using something like LDAP?

There is an LDAP integration module and an LDAP provisioning module. Both of which work quite well.

Answer 2

You might like to take a look at Development Seed's "Simple Sign-On with OpenID" blog post. I believe it's only a proof of concept, but they use OpenID to do single sign on across a network of sites.

Answer 3

Old question, but I've just used OpenID Provider successfully to login to a Drupal 7 site (the relying party) using an account created on another Drupal 7 instance (the provider).

Just enable OpenID Provider on the provider (not surprisingly) then enable the core OpenID module on the relying site, and point the OpenID URL to the provider's URL.

The email was transferred across. I haven't tested other fields. In addition, I wasn't able to change my password or email on the relying site - my provider account's password wasn't accepted.

Answer 4

interesting problem, I'm faced with the same challenge soon. I'm new to Drupal so I don't have a definite answer. However I'm looking at http://www.janrain.com/ (formerly RPX). They provide different login solutions and one specifically for "federated sites": http://www.janrain.com/products/federate There is a Drupal module for it http://drupal.org/project/rpx

Some details from the module's project page:

The Janrain Social Login module integrates Drupal sites with the Janrain Social Login service.

Using Janrain Social Login, Drupal sites can authenticate new and existing users with popular social networks, map user profile data from these websites to Drupal fields, and share Drupal content with a user's friends on their social networks.

The module helps Drupal websites quickly and seamlessly integrate with 30+ social networks includingFacebook, Twitter, Google, Yahoo!, LinkedIn, AOL, PayPal, and Microsoft Account.

Instead of having to integrate with each of these sites on your own (and manage API changes over time), Janrain Engage does the heavy lifting for you. Using this module, you can get setup in under 10 minutes. The result is an accelerated user registration process, an enhanced ability to gather user data, and increased site traffic from the viral promotion of your content.