Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a single sign-on for my intranet. I've found a couple solutions online but I'm not sure if they apply to my particular situation.

I have several subdomains on the same server. One level of user should be able to access all subdomains and another level of user should only be able to access some subdomains.

Signing into one subdomain should make it so you don't have to log into any others.

Can anyone point me in the right direction? I'm on Ubuntu using Apache.

share|improve this question
up vote 1 down vote accepted

I'm not 100% sure of the solution, but I'm fairly certain you can run an LDAP server and have apache authenticate to it through the use of mod_ldap. You might want to scope out this article to see if it's what you want:

From there you should be able to create user groups in ldap and configure apache to reflect group access for different folders.

Fair warning, I've never actually done this before, so it might not be what you want.

Also, it looks like apache now has its own directory server project, I've only ever used Fedora-DS now 389-DS, should be pretty similar though:

share|improve this answer
I'm sure this is the best answer. However, the stuff in those links is over my head. I'm going to do what I did with my DNS server when I couldn't figure it out with the internet: buy the book. – Jason Swett Oct 4 '10 at 17:38

How will you authenticate your users? PHP/mysql? if so you could just use cookies

share|improve this answer
Cookies don't usually cross domains – symcbean Oct 1 '10 at 10:58
@symcbean OP has subdomains on the same domain, so cookies will work in this situation. – Evgeny Jun 21 '12 at 2:06

Here is what I propose (situation of strictly Intranet - subdomains of the same web domain):

On the identity provider after main authentication code call a method that:

  • sends encrypted data about logged in user to the consumer
  • receives and verifies the response with the signed login cookie
  • returns name and value of the cookie

after the method is returns - set the cookie for the subdomain.

On the identity consumer service:

  • receive data of the method
  • decrypt it
  • if user does not exist, create his/her account
  • determine the session cookie
  • sign the cookie
  • send the cookie name, value and the signature back to the identity provider

This is easier to set up than OAuth, LDAP etc, but will work only with the subdomains, given that cookies cannot cross domain bounds.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.