Single Sign-On in SharePoint

Question

We have a requirement to implement ‘Single Sign-On’ for SharePoint and a Java application.

We have a Java web application running on JBoss server with normal authentication and authorization process against an Oracle database. The idea is that a link should be provided in the SharePoint application to access the Java application and when the link is clicked the Java application should directly open without asking for further login credentials.

The SharePoint application uses AD for authentication and authorization whereas the Java application uses its own database for the same.

Answer 1

I have done something similar to this. I use MOSS SSO (which really should be called a Credential Mapper to avoid disappointed customers) to create requests that automatically log users into an external system. There is custom code required, and I do it all through an application page and is surfaced via a link in SharePoint. I used Joe SharePoint's Twitter sample as a starting point: http://www.joesharepoint.com/?p=4

One caveat: changes in credentials in the external systems are not propagated to the MOSS SSO database. Also, there are some backup constraints for the SSO encryption key (removable storage only). Finally, if the application is not on the same domain, then you have to use an AAM. You can only have a TOTAL of five zones, so at most, you are looking at four non-domain applications (probably closer to 2 or 3 if you use the intranet/extranet/internet zones).

Furthermore: MOSS SSO only works with AD (not an issue in your case). If you want to use FBA, you need to roll your own SSO provider.

What I would recommend instead: Can your Java application be made AD aware? If you do this, you can set up ISA to share credential across all applications in the domain. This resolves the multiple accounts/passwords per user issue.

If you choose to go the above route, I would make sure to get familiar with IEDeveloperToolbar or FireBug beforehand to make sure you can validate HTTP requests and Cookies.

Answer 2

There comes a single sign on feature with SharePoint 2007. But as far as I know it is based on storing credentials for the other system (the Java web application in your case) within SharePoint.

But from a it-security point of view this solution is not very good.

Answer 3

The Single Sign-On can accommodate this. While the credentials are in the SharePoint system, they are secured. In many cases I believe it would be easier to hack the secondary system than it would be to get at the credentials managed in SharePoint.