Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

We have a "backend" area for performing maintenance/debugging tasks on most of our developed websites and (obviously) this area requires authentication.

Most of these websites have their own authentication system, but it's ruled out because often the website is broken (that's why we need access to the debugging/maintenance area!)

We need a way to verify that the person trying to access the maintenance area is currently an employee of our company, without requiring that the rest of the website is functional, perhaps the database doesn't exist yet for example (one maintenance task is to create the database). Simple password authentication is all we really want, and it's OK if everyone uses the same password provided we can change the password in a central location whenever someone leaves the company.

Right now we are using OpenID (with a fixed URL hard coded into the site), but it's incredibly complicated and the implementation we are using has proven buggy/unreliable.

Is there some light weight alternative to OpenID?

Or does anyone know how to create such a system? I've got a fairly good grasp of general cryptography theory, but I can't think of anything I'm certain is going to be secure.

I'm thinking the "client" website would redirect the user to a central authentication server, where after accepting a password it encrypts the current date using a private key (openssl?) and sends them back. The client website confirms the date is recent and the signature is valid, then stores it in a session cookie and allows the user to access the area.

share|improve this question
add comment

3 Answers

.htaccess file ( or in http.conf ) in Apache as a front end, can be maintained with vi over an ssh session, doesn't get any simpler and lightweight than that.

share|improve this answer
    
That's not an option for us, we only use apache to load static files. Every other http request goes to a single php file which takes over from there. –  Abhi Beckert Jun 13 '12 at 23:47
    
that sounds like a terrible architecture ... –  Jarrod Roberson Jun 13 '12 at 23:56
    
We used ModRewrite for nearly 10 years before finally deciding it is unacceptable, and creating something better. Trust me, what we're doing is more suited to our needs than htaccess (we do use htaccess, but can't use all of it's features, including auth). –  Abhi Beckert Jun 14 '12 at 2:28
add comment

You should use Mozilla's BrowserID. If you don't want to use a database, just make sure the user that returns has a company email before you start their session.

share|improve this answer
add comment

Have you looked at shibboleth (shibboleth.net), simplesamlphp (simplesamlphp.org), OpenAM (forgerock.com/openam.html)?

shibboleth and simplesamlphp are implementations of SAML where you can setup a dedicated Identity Provider and have someone that is needing access to debug a client site (called a Service Provider according to SAML) they can be redirected to the Identity Provider for that site and then upon successful authentication be passed back to the Service Provider with a secure token.

EDIT: simplesamlphp is the most lightweight (IMO) out of the three I mentioned.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.