title: How to implement single sign on across multiple JVM based applications using Spring Security
body: <p>I am currently trying to implement a single sign on solution across multiple JVM based (Grails, Servlets) web applications currently all deployed in the same servlet container (currently Tomcat, but don't want to limit my solution to just Tomcat).  All web applications share a common database.</p>
  
  <p>I've looked at various options from using CAS or other third party libraries to creating a new web service to handle Single Sign On, but none seem to really satisfy the business.  My current implementation involves creating a new jar library which has a common implementation of <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/authentication/AuthenticationProvider.html" rel="noreferrer">AuthenticationProviders</a>, and <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/reference/preauth.html" rel="noreferrer">Pre-Authentication Filters</a> based on Spring Security.</p>
  
  <p>In this approach I have multiple AuthenticationProviders (currently Active Directory, and Database) for the application to authenticate against.  Upon successful authentication a row would be inserted in a session table that contains the user, an expiration time, and a token.  The token would be also stored as a cookie on the user's machine and that would be used to validate they have a current session in the Pre-Authentication Filters.</p>
  
  <p>Having never done this before I want to make sure I'm not creating a huge security problem, and I'd also like to know what I would need to create the token?  At this point a simple GUID seems to be sufficent?</p>
  
  <p>Currently we are working on Spring Security 3.0.x, and haven't upgraded to 3.1 yet.</p>
  
  <p>Thanks in advance.</p>