Einar S. Idsø wrote:
We have a number of different community sites that will use a
single central OpenLDAP-server for authentication. We want
each site to provide its users with a logon-box for that site, just
as any forum or portal you can find out there. Each site has its
own admins with full access to everything related to their specific
site. This makes it possible for them to edit their own logon
mechanism to capture passwords for users that log on to their
site. Thus an admin on one site can capture the password of an
admin on another site, which is an obvious security issue.
Yupp, that's a problem with single password stores.
We can of course redirect logons to a common secure webpage,
or monitor files in the respective sites' webroot to detect
modifications to logon procedures, but we'd really prefer a
cleaner solution if at all possible. Do any mechanisms exist
to avoid this problem?
Not sure what a "cleaner solution" means for you. But this is a typical
deployment scenario for Web SSO components. Personally I'm fairly
familiar with CAS. There's also OpenSSO and some others which all work
almost in the same way. But you have to do some integration work in the
web server/application.
Ciao, Michael.