I have a REST API server with its own authentication methods. I need to provide to some third party apps an authentication solution which should be processed on my server, I don't want them to handle the user's credentials.
After some research I found that in order to avoid using a third party solution as Auth0 I may need to implement my own Identity Provider, this is were I'm starting to get confused.
- Having in mind that the solution need to authorize only users from my app, should the Identity Provider be a separate app ?
- The SSO will be made on my server, so how can I pass the result to the third party apps ?