We have a "backend" area for performing maintenance/debugging tasks on most of our developed websites and (obviously) this area requires authentication.
Most of these websites have their own authentication system, but it's ruled out because often the website is broken (that's why we need access to the debugging/maintenance area!)
We need a way to verify that the person trying to access the maintenance area is currently an employee of our company, without requiring that the rest of the website is functional, perhaps the database doesn't exist yet for example (one maintenance task is to create the database). Simple password authentication is all we really want, and it's OK if everyone uses the same password provided we can change the password in a central location whenever someone leaves the company.
Right now we are using OpenID (with a fixed URL hard coded into the site), but it's incredibly complicated and the implementation we are using has proven buggy/unreliable.
Is there some light weight alternative to OpenID?
Or does anyone know how to create such a system? I've got a fairly good grasp of general cryptography theory, but I can't think of anything I'm certain is going to be secure.
I'm thinking the "client" website would redirect the user to a central authentication server, where after accepting a password it encrypts the current date using a private key (openssl?) and sends them back. The client website confirms the date is recent and the signature is valid, then stores it in a session cookie and allows the user to access the area.
