Hallo:

My problem is:
- A webclient (WC) tries to access a web server (WS), but this requires an authentication obtained from a key server (KS).

So what I do:
- The WC tries to access a page in the WS, but this return an error saying that requires to authenticate (really, it requires a ticket saved in a cookies).
- So the client is redirected to KS to obtain the cookie, this is returned to the client, creates the cookie to access the WS and retries the access to the WS.
And this way, it works.

This is the idea, but really, it's a bit more complicated. In detail:
- When WC receives the error, it creates a hidden iframe which calls the TS for generating the ticket. The TS returns the ticket in the iframe. But I don't create the cookie there because I want the cookie to be used for url of WS. So I call a page of WS called "saveTicket.jsp?ticket=xxxxx" which saves the ticket in WC.
With the ticket saved for server WS, the WC retries the url and access.

My problem is that it's a bit complicated mechanism. For requesting the ticket, I've to use get method. If use post, not all navigators work (IE6, IE7, firefox 3.0, konqueror). And even konqueror doesn't work with iframe and get.

So, what's the best way for implementing a "SSO/requesting data" between servers (they can be in a different domain)?

Is there an easiest way to do this mechanism?

Thanks

Sounds like you're tring to work around the same-origin policy of cookies.

Can you not make the KS provide the ticket details as XML, that you can then easily get and use to form your WS query/cookie?

I'm assuming your WS is validating that the WC is authorised as well as authenticated before it lets saveTicket.jsp?ticket=xxxxx work? Otherwise you sound ripe for XSS exploits and just general problems with spiders, proxies & prefetchers.