security - Is the following scheme for sessions distributed over multiple services secure? -

i'm developing client/server application communicate on internet. server consist of number of distinct services, , want user have authenticate once.

the scheme have in mind archiving having central authentication service (over encrypted connection identity of server authenticated first) authenticates user , generates "large enough" session id using secure random number generator. each service client needs access on, creates new connection, authenticates server (using certificates , ssl example) , sends secure session id prove authenticated given session. service contacts centralized authentication service verify session valid , active before responding other requests.

are there disadvantages scheme compared using challenge/response on session id or authentication cookies signed server? services trusted, there's no need protect against service (ab)using session id of connection impersonate user.

a major concern client in charge of transmitting session id or post request between servers, makes system vulnerable session fixation. description isn't clear how session state being transfered or in charge of information.

i agree cookie should large random number called cryptographic nonce. variable used key access server side state. in case of distributed session easiest solution have individual server or database can made responsible maintaining state across domains. makes things easier because user can work on multiple domains simultaneously without worry of race conditions. when server needs set or obtain session variable make request communal session server.

to transfer user 1 server without introducing session fixation vulnerability create 1 time use "transfer id", should cryptographic nonce. communal server knows user has been flagged transfer. client browser transmits "transfer id" new server, new server looks user based on "transfer id" , new server regenerate session id used domain. 1 way method use traditional session handler insure each server has unique session id. individual server can store state information link session id specific user's state on distributed system.