关于Java EE Soteria实现多域独立服务器单点登录的技术问询

Great question! Let’s break this down clearly for you.

Short Answer: Yes, absolutely #

Soteria (the reference implementation of Jakarta Security API) can absolutely power single sign-on (SSO) for multi-domain web apps deployed on standalone servers. The key is aligning its core security mechanisms with cross-domain identity sharing strategies—either via shared session stores for subdomains, or standard protocols like OpenID Connect (OIDC) for fully separate top-level domains.

Implementation Guide #

Below’s a step-by-step breakdown to get this working:

1. Prep Your Environment #

• Ensure all your web apps are deployed on standalone servers that support Jakarta EE 8+ (e.g., Tomcat 10+, Jetty 11+, WildFly 27+), since Soteria relies on Jakarta Security APIs.
• Set up a shared identity store (like a centralized JDBC database or LDAP server) that all apps can access to validate user credentials. This ensures consistent user data across domains.

2. Configure Soteria for Subdomain SSO (e.g., app1.example.com, app2.example.com) #

If your apps share a parent domain, session-based SSO is straightforward:

• For each app, define a shared IdentityStore pointing to your centralized user store. Example Java config:

  @IdentityStoreDefinition(
      type = IdentityStoreType.JDBC,
      dataSourceLookup = "java:comp/env/jdbc/SharedAuthDB",
      callerQuery = "SELECT password FROM users WHERE username = ?",
      groupsQuery = "SELECT group_name FROM user_groups WHERE username = ?"
  )
  public class SharedAuthConfig {}
  

• Configure cross-domain session cookies: On your server (e.g., Tomcat), set a global session cookie with a parent domain value (e.g., .example.com) so it’s accessible across all subdomains. Use a distributed session store (like Redis) if apps are on separate servers, so sessions are shared across instances.
• Add consistent security constraints in each app’s web.xml to protect resources and map roles uniformly.

3. Configure Soteria for Cross-Top-Level-Domain SSO (e.g., app1.com, app2.org) #

For entirely separate domains, session sharing won’t work—use OpenID Connect (OIDC) with Soteria:

• Set up an OIDC provider (you can self-host one like Keycloak, or use a managed service). All your apps will act as OIDC clients.
• In each app, configure Soteria’s OIDC authentication module. Example Java config:

  @OpenIdAuthenticationDefinition(
      providerURI = "https://your-oidc-provider.com/auth/realms/your-realm",
      clientId = "app-client-id-1",
      clientSecret = "app-client-secret-1",
      redirectURI = "${baseURL}/oidc/callback",
      scope = {"openid", "profile", "email"}
  )
  public class OidcAuthConfig {}
  

• When a user visits any app, they’ll be redirected to the OIDC provider to log in. After authentication, the provider issues tokens that all apps can validate, enabling seamless SSO across domains.

4. Test & Validate #

• Launch all apps and attempt to access protected resources on different domains. Confirm you only need to log in once.
• Verify session cookies (for subdomains) or OIDC tokens (for cross-top-level domains) are being shared/validated correctly across all apps.

内容的提问来源于stack exchange，提问作者Cadrian Brown