3

We have a web application and our partners asked us to log in silently from their web applications, which would allow their users to make a single login on l to access our application instead of two.

Obviously, their applications are different from ours and need to remain separated. They also need to have their own separate login pages.

At first we wanted to integrate an SSO like Identity Server, but can it handle this scenario? Can a web request be sent to an SSO for login silently for the user without redirecting the browser to the second application?

The second solution is to create a button on the external application that calls our application. It would pass the token generated by us with a sort of private and public key.

1 Answer 1

3

Usually a website will force redirection for login for security reasons. It prevents the website ever seeing the password.

However, If the user has already logged in on the partner site, they should have a token already generated. There's no reason they cant pass it to your site without re logging in.

I guess the most common way of doing this would be to have the partner site store the token as a cookie. Your site can make an ajax call to the partner site, which will receive the token and return a token and refresh token to your site. You can now use the token to authenticate the users requests.

With many SSO solutions this kinds of thing would happen automatically if the other has an existing unexpired refresh token

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.