How to Build a Unified Enterprise SSO System with Go and Vue

Pain Points

1. Multiple login experience Employees often need to log into many systems (Grafana, Jumpserver, Jira, GitLab, Jenkins, etc.) each with separate credentials, leading to password reuse and security risks.

2. Security risks and management challenges Enforcing strong, unique passwords for each system increases complexity, causes forgotten passwords, and raises operational costs for password recovery, account lockout, and identity verification.

3. Administrator burden Managing user identities and permissions across numerous applications is time‑consuming and error‑prone, especially during onboarding and offboarding.

What is Single Sign‑On (SSO)

SSO (Single Sign‑On) is an authentication technique that lets a user log in once and gain access to multiple trusted systems without re‑entering credentials. It improves user experience and reduces password fatigue.

How SSO Works

The core idea is a centralized identity provider. After a user authenticates to the provider, the provider issues a token that trusted applications accept, allowing seamless access without additional logins.

Common SSO Protocols

OAuth2.0 – widely used for web application authorization.

SAML 2 – XML‑based enterprise authentication protocol.

OIDC – an extension of OAuth2.0 for identity verification.

CAS – enterprise‑grade SSO protocol used in large organizations.

Benefits of SSO

1. Improved user experience Users log in once and access all authorized systems, boosting productivity and reducing password‑related issues.

2. Enhanced security Centralized authentication enables strong policies such as MFA, reduces the number of exposed login points, and lowers attack surface.

3. Lower IT operational cost Administrators manage permissions in a single system, synchronize identities automatically, and handle onboarding/offboarding efficiently.

Solution Overview

An open‑source SSO system built with Go (backend) and Vue (frontend) is available at https://github.com/yuyan075500/ops-api . It supports Windows AD, OpenLDAP, DingTalk, WeChat Work, and Feishu for user sources.

Key Features

1. Authentication methods – AD, OpenLDAP, DingTalk, WeChat Work, Feishu (QR code).

2. Supported protocols – CAS 3.0, OAuth2.0, SAML 2, OIDC.

3. Security – Multi‑Factor Authentication (Google Authenticator, Alibaba Cloud App, Huawei Cloud App).

4. Operational efficiency – Self‑service password management, unified password change, strong password policies without admin intervention.

Deployment Steps

Prepare a Linux server (2 CPU, 4 GB RAM) with Docker and Docker‑Compose installed.

git clone https://github.com/yuyan075500/ops-api.git

cd ops-api/deploy/docker-compose

Configure environment variables in .env if you do not use the provided MySQL, Redis, and MinIO containers.

Update conf/config.yaml to set externalUrl to your actual access address.

Create a MinIO data directory: mkdir -p data/minio Start the services: docker-compose up -d Import the initial SQL file ( deploy/data.sql) into MySQL.

After deployment, a super‑user is created automatically (username: admin, password: admin@123...).