Project description
TranslatedWe already have a working web application with its own account system, and we're not asking you to rewrite it from scratch. The task is different: add single sign-on on top of the existing behavior so users can authorize through providers they already trust. For regular clients, these are familiar social login buttons, and for corporate customers, the ability to connect their own identity provider so employees can log in with their work credentials. The essence of the work is careful integration and correctness, not inventing a new login screen: the result should look like part of the current interface, not a bolted-on block on the side.
Specifically, you need to implement standard OAuth flows for social providers and SAML flow for corporate identity, securely handle the return and token exchange, and ensure reliable token refresh so users aren't kicked out in the middle of work. An important part of the value is mapping the received identity to the roles and rights already in the application: an incoming account should fall into the right group with the right access, and unknown or unconfirmed users should be handled correctly. Existing local accounts must continue to work, and when email matches, we want reasonable binding of the external identity to an existing account without creating duplicates.
We ask you to treat security as the meaning of the project, not as an addition. We expect state and nonce verification, protection against replay and token leakage, storing secrets outside the client, and a brief note on how everything has been tested. Budget and deadlines are listed below, and we're ready to discuss a brief written plan before starting.
— Login through multiple social networks via OAuth, integrated into the current interface
— SAML flow for corporate providers with metadata exchange
— Reliable token refresh and sessions without forced logouts
— Mapping roles and rights of the incoming identity to our groups
— Binding to local accounts by confirmed email, without duplicates
— Security notes: state, nonce, replay protection, secrets
Specifically, you need to implement standard OAuth flows for social providers and SAML flow for corporate identity, securely handle the return and token exchange, and ensure reliable token refresh so users aren't kicked out in the middle of work. An important part of the value is mapping the received identity to the roles and rights already in the application: an incoming account should fall into the right group with the right access, and unknown or unconfirmed users should be handled correctly. Existing local accounts must continue to work, and when email matches, we want reasonable binding of the external identity to an existing account without creating duplicates.
We ask you to treat security as the meaning of the project, not as an addition. We expect state and nonce verification, protection against replay and token leakage, storing secrets outside the client, and a brief note on how everything has been tested. Budget and deadlines are listed below, and we're ready to discuss a brief written plan before starting.
— Login through multiple social networks via OAuth, integrated into the current interface
— SAML flow for corporate providers with metadata exchange
— Reliable token refresh and sessions without forced logouts
— Mapping roles and rights of the incoming identity to our groups
— Binding to local accounts by confirmed email, without duplicates
— Security notes: state, nonce, replay protection, secrets
Web programming Cash, Bank transfer
