How to properly and securely implement SSO for a project?

Question

PHP

There are several web projects. Let's assume that the domains are https://site1.ru , https://site2.ru and https://site3.ru. You need to link them. Having passed authorization in site1.ru, the user should automatically become logged in on other projects.
I assume that we are making an authentication center (for example https://auth.ru ) with all information about users.
Next, we use the following scheme:
from https://site1.ruthe login and password are sent to the authorization server. In case of successful verification of data on auth.ru, we generate a session id and run a script on each of the projects (with checking the domain of the server from which the request came), which in turn will set the httponly cookie with the passed id. We write a unique key['value'] to the session, with which we then check whether the authorization is still alive.
To heighten the effect, once every N minutes we regenerate the master token and send it to all projects that we already salt the data transmitted from the site to the authorization server.
What could I be missing and where are the weaknesses in this solution? Thank you.

Answer 1

You need to use SAML.
In this case, you will have an authentication server (Identity Provider), and your sites (Service Provider) will use it to authenticate users and, if the user is already authenticated on one of the resources, then SAML will provide SSO.
I can advise neXus Hybrid Access Gateway.