API to allow SSO to Google Web interface (without using SAML)

[Brian Gibson]

Hi all,

I am looking for suggestions on how to do SSO from our web portal (Luminis IV) without using SAML. Luminis can provide my custom PHP app with the user's Google Apps for Edu login name and password and if need be it can have access to our domain's authentication token for access through the Google Apps APIs. The problem I am running into is our Google login page https://www.google.com/a/wheatoncollege.edu drops a session specific cookie in the user's browser before they login so I can't just build an invisible Google web form that is already filled in and submit it on the fly (since I do not have the cookie info). I've also tried opening up the Google login page in a separate window and filling in the form and submitting it but I believe it is considered cross-site scripting since I couldn't reference the DOM elements on the Google login page from the parent page.

There must be a way to do this. Our old mail server had a Perl API interface and from there I could create a session for the user then redirect the user into that session... can I do something like that with Google?

We have specific reasons why we do not want to do SAML which (I know, I know) is the preferred method.

Thanks!