title: Single Sign On / Token-Based Authentication process
body: <p>I have searched the forum for some resources:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/4671928/security-of-token-based-authentication">Security of Token Based Authentication</a></li>
  <li><a href="https://stackoverflow.com/questions/7836045/is-token-based-authentication-secure-when">Is token based authentication secure when</a></li>
  <li><a href="https://stackoverflow.com/questions/4588866/implementing-a-token-authentication">Implementing a token authentication</a></li>
  </ul>
  
  <p>I am bouncing around ideas on implementation of single sign-on / token based authentication process. Roughly, requirement would be:</p>
  
  <ul>
  <li>User web app / mobile app / mobile web, etc</li>
  <li>System 1: User info and login information, generate token and provide some services (eg. <code>getUserData</code>)</li>
  <li>System 2: An external party that has control over user specific data </li>
  <li>System 3: Yet another external party like System 2</li>
  <li>User need to only sign in once at System 1, and then able to communicate with System 2 and System 3</li>
  </ul>
  
  <p>Think about bank, or something like Mint.com, after initial setup, user can sign in once through Mint which then have access to go to your banks (and possibly multiple banking institutions) - thus gaining access to different systems with a single sign in. However, in my case it will be more than just read-only access that Mint.com is doing.</p>
  
  <p>My initial thought roughly looks like this:</p>
  
  <pre><code>User Sign In ----&gt; System 1, login verification generate token for itself (call it token1)
  System 1 ---&gt; generate token and pass it to System 2 (call it token2)
  System 1 ---&gt; generate token and pass it to System 3 (call it token3)
  System 1 ---&gt; return [token1, token2, token3]
  </code></pre>
  
  <p>From here, user (ie. the app or site, etc) have 3 tokens that it can use to communicate. If user need to execute action / retrieve data from System 1, it will pass in token1 with the request, etc with System 2 and System 3</p>
  
  <p>Is this approach make sense?</p>
  
  <p>There are of course security concern around this - what if the token is stolen somewhere along the way and now somebody with that token can execute actions on the system the token is for - obviously, this would be bad for things like banking system.</p>
  
  <p>How does the System verify that the request sender that that give the token actually is the legitimate user the token was generated for? </p>
  
  <p>One thought is 2nd authentication level, ie. with every request the user make, it needs to enter a special code (eg. like your bank card PIN) to go along with the token in the request - but doesn't this get annoying? Every request, user has to enter a PIN.</p>
  
  <p>Thoughts and comments would be greatly appreciated.</p>
  
  <p><strong>EDIT:</strong>
  I already looked at OAuth ... As far as my understanding goes, you need to implement an OAuth provider that generates the token and allow you to use it with the OAuth provider itself, in other words, the OAuth provider is System #1 - but how can I make System 2 and 3 accepts that OAuth token as well?  Or may be I misunderstood OAuth.</p>
  
  <p>Also, even if using OAuth will work with the way I want it (System 1, System 2, System 3, etc), the question remains: What if an external malicious party gain access to that token? How can I identify to make sure the one using the token is the authorized party?</p>