I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle the user's credentials.

After some research I found that in order to avoid using a third party solution as Auth0 I may need to implement my own Identity Provider, this is were I'm starting to get confused.

  • Having in mind that the solution need to authorize only users from my app, should the Identity Provider be a separate app ?
  • The SSO will be made on my server, so how can I pass the result to the third party apps ?
  • 2
    There's an excellent explanation about the concepts behind OAuth and OpenID Connect here: developer.okta.com/blog/2019/10/21/… (The concepts are the same regardless of whether you use a third party or host your own identity server) Feb 26, 2021 at 1:04
  • I am not clear on the requirements. Are you saying that people who use your app should also be able to access these third party services? Or are you expecting the third party services to access your REST API? Or something else?
    – John Wu
    Feb 26, 2021 at 18:31
  • It's not a good idea to implement your own security code especially if you aren't a security expert. I assume that the concern with using a third party solution is cost? If so, I suggest keycloak.org. It's free and open source and easy to use. Mar 6, 2021 at 18:44

1 Answer 1


Hi SSO usualy works like this. You have the following entities - User, Service Provider and Identity Provider

  1. User requests target resource from the Service Provider
  2. Service provider sends a request to Identity Provider.
  3. Identity Provider validates request and request User to login.
  4. Identity provider sends response (can be token)
  5. User sends token to Service Provider
  6. Service provider validates token and redirects(gives access) to the resource.

The Identity Provider is a separate application. "So how can I pass the result to the third party apps ." - Each participant in the SSO should have ability to verify the token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.