Google Apps domain integration

Question

We have a Java web application (using struts and hibernate) and want the users to automatically log into the Google apps domain accounts.

We have set up the Google apps for Education domain accounts and created the users in it and we have the same users in our java web application also.

The requirement is that when the users log into our application portal, their is a link to go to Google apps, once they click on this link, it should log them in without asking for password.

We are using Tomcat 7 as our server for the web application. Which SSO tool should we use for doing this? Oracle's SSO is paid, Shiboleth doesn't work with Tomcat 7.

Any help highly appreciated? Is SSO the only option or another way to do this.

Thanks

Answer 1

Any SSO solution that supports the SAML2 protocol should work. Apart from the expensive solutions that Oracle, IBM, CA and others provide, you can find the following solutions that definitely work well with Tomcat7 and are open source :

• Apereo (ex Jasig) CAS : Used quite a lot in the education community. Simple to setup but specific configurations (like an advanced authentication module) might require some programming effort. It supports Google Apps authentication, but none other SAML2 service. If you really want to only login to Google Apps, that's a great and simple solution.

• Forgerock OpenAM : Formerly Sun OpenSSO, this is used in education and industry. Many more features, supports most of the SAML2 service providers out there including Google Apps, but more complex.

Note that if you already have a portal solution, you should check if that portal does not already support SAML2 federation and could act as the SSO server.

Note also that you will need to link the portal authentication and the SSO server authentication, to make sure that your users do not authenticate twice. This can be done in two ways :

1. Tell the SSO server to delegate the authentication to your portal solution. This might require some light custom coding depending on your portal.
2. The opposite : tell the portal to use the SSO as an authentication solution. Most portals support some kind of authentication delegation so it should only be configuration?

Lastly, if your authentication is setup on Tomcat itself (that is if your portal already delegates the authentication to the Tomcat container), then you can do the same for the SSO server.