We have a web application and our partners ask us to login silently from their web applications allow their users to make a single login on their sites without login twice to access our application.

Obviously, their and our applications need to remain separate applications and, in another context, needs to have their own login page.

At first, we thought to integrate an SSO like Identity Server but can it manage this scenario? can, a web request, be sent to an SSO for login silently the user without redirecting the browser to the second application?

The second solution is to create a button on the external application that calls our application passing token generated by us with a sort of private and public key.


Usually a website will force redirection for login for security reasons. It prevents the website ever seeing the password.

However, If the user has already logged in on the partner site, they should have a token already generated. There's no reason they cant pass it to your site without re logging in.

I guess the most common way of doing this would be to have the partner site store the token as a cookie. Your site can make an ajax call to the partner site, which will receive the token and return a token and refresh token to your site. You can now use the token to authenticate the users requests.

With many SSO solutions this kinds of thing would happen automatically if the other has an existing unexpired refresh token

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.