The Central SSO Protocol Specification

One cryptographically signed session ticket grants seamless Single Sign-On (SSO) access across 7 enterprise SaaS platforms without re-authenticating or leaking student credentials.

TOKEN LIFECYCLE

Cross-Subdomain Session Propagation

1. Initial Handshake

User submits credentials once via atlas.pitechpedia.com/login. Credentials undergo Argon2id password verification against central identity stores.

2. Cookie Delegation

Central gateway sets a signed, Secure, HttpOnly, SameSite=Lax cookie on apex .pitechpedia.com with ECDSA signature verification.

3. Sub-Second Validation

When student navigates to Pi-Campus or Pi-Intern, the respective microservice verifies the ticket locally via public key in under 12ms.

4. Global Revocation

Clicking "Sign Out" from any platform instantly invalidates the session ID across the distributed Redis blacklist cluster.

                    // Verification via central sso_helper.php

                    $currentUser = validateSsoToken();

                    if ($currentUser) {

                        echo "Authenticated: " . $currentUser['email'] . " | Coins: " . $currentUser['pi_coins'];

                    }