Implementing SSO on a REST API

Question

I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle the user's credentials.

After some research I found that in order to avoid using a third party solution as Auth0 I may need to implement my own Identity Provider, this is were I'm starting to get confused.

• Having in mind that the solution need to authorize only users from my app, should the Identity Provider be a separate app ?
• The SSO will be made on my server, so how can I pass the result to the third party apps ?

Answer 1

Hi SSO usualy works like this. You have the following entities - User, Service Provider and Identity Provider

1. User requests target resource from the Service Provider
2. Service provider sends a request to Identity Provider.
3. Identity Provider validates request and request User to login.
4. Identity provider sends response (can be token)
5. User sends token to Service Provider
6. Service provider validates token and redirects(gives access) to the resource.

The Identity Provider is a separate application. "So how can I pass the result to the third party apps ." - Each participant in the SSO should have ability to verify the token.