Corporate single sign-on for 22 internal apps

Context

La Casa de las Carcasas is a mobile accessories retailer with more than 5,000 employees, more than 1,200 stores worldwide, and warehouses in Europe and Latin America. Its teams work with more than 22 internal applications.

Problem

Every internal app had its own login. That had two costs:

• Duplicated work. Developers had to build authentication again for every new app, and then maintain each version separately.
• More places to leak. Every login was a separate entry point where credentials could be exposed, each with its own implementation to keep secure.

What I did

• Built a corporate single sign-on service with Laravel, so apps delegate login to one place instead of implementing it themselves.
• Added OAuth 2.0 delegated tokens, so one app can request data from another app's endpoints securely, on behalf of the user.
• Stored sessions in Redis, and optimised the calls between the apps and the SSO to keep the delay of every navigation to a minimum.
• Built private Composer and npm libraries that the apps use to integrate with the SSO.
• Rolled it out app by app: it is live in 22 internal apps and being deployed to the rest.

Result

• 22 internal apps in production, with the rest being rolled out.
• About 9,000 potential users across the company.
• One authentication to build, maintain and secure, instead of one per app.

Stack

Laravel, OAuth 2.0, Redis, and private Composer and npm packages.

What I learned

Mostly technical lessons: how much a well-implemented single sign-on can do. OAuth 2.0 tokens between apps are the clearest example. Once the apps share identity, one app can ask another for data through its endpoints, securely and on behalf of the user.

It also made me work hard on optimising calls, so that navigating between apps adds as little delay as possible, and on designing private Composer and npm libraries that many apps depend on at the same time.