Secure data transfer between servers

Question

i got a little odd situation to develop.

The MVC web system my team has to develop (or project is made with rails), will rely on login/password from another site.

The idea is, the user will have a log-in on the third part site, and somewhere relevant, will exist a link to our site. When the user click on that link, we need receive from the site, some data of the user.

We have no control of the third part server, or direct access to their database. Plus, making then make any change to their application/infrastructure is a BIGDEAL so i am searching for a solution with less impact for then. (Of course they will have do change something but will be a political issue, so the less, the better)

From our viem, we need to be sure that the user really come from the third part site (and only from there), and we not have received a fake message from an attacker.

Their site have an valid SSL certificate working. (no idea if my system will have one (it should)) Not sure if its relevant, but we think that their server is an oracle aplication server, who connect to a oracle server in their internal network.

I first thought in using just SSL, but i not sure how to do it (what i have to check, what i have to change?) and if is safe enought.

My second thought is to use PGP keys, and make then sing and cryptography the data before sending to us, and, the link yo our site, would make a post to a control on our server which would verify and de-crypt the data.

Anyone have any tips/pointers/thoughts that could help me?

Answer 1

If both servers are using SSL, and supposing the server give you at least a json or xml interface, should be ok to simply make a secure request (using, for example, rest-client) and evaluating the response in your server.

Most likely you will want to cache user data on login in your server, and if user/password aren't found, look in the other server - this will reduce the load.