Repository navigation
Replies: 1 comment 3 replies
|
I do not think you can directly reuse the cookies from one application in another (since the browser will usually block you from doing that). If the first application requires some functionality from the second app, it could include a bearer token in GET / POST requests to the second application, but this is usually meant for communication between services (e.g. to get a resource's state in a dashboard application, you may use the token to fetch the state from a separate controller application). The behavior I have observed in most applications that automatically log you in is implementing a redirect to the login page (the endpoint that authenticates users through OIDC) whenever you visit a page and you are not logged in. This can take any shape, but the application probably keeps track of the user expected flow using some parameters - e.g. when visiting Since the user is already authenticated in Keycloak, they should not have to enter their credentials again when the second application needs to authenticate them (this is the main purpose of an SSO). For auditing purposes, you probably want Keycloak to keep track of all user sessions - both the first and the second application independently; as you have described it, the user would reuse the session from the first app, basically making authentications in the second application invisible to Keycloak. |
|
Thank you! This is very helpful Information. Currently if you visit app 2 and it redirects you to Keycloak, you still have to enter credentials again, even if you are already logged in and have an active session in app 1. |
|
It should be enabled by default. Check that cookies are enabled as a valid authentication alternative in the Browser flow. They should be set as |
|
Do note that you may also use a different Browser authentication flow, that is either set as the default for all OIDC clients, or for the specific client in the client's advanced settings. |
Uh oh!
There was an error while loading. Please reload this page.
Hello,
Im currently struggling to implement "seamless" SSO between two different OIDC applications.
We have a self developed main application that uses a keycloak OIDC client as idp.
We now want to integrate a secondary, self hosted third party app. This secondary app ("Budibase") also supports OIDC and I've successfully set up keycloak as its idp. In this secondary app, I can click "login via OIDC" and it will redirect me to the keycloak login page where i can enter my credentials.
However, what we really want is "seamless" SSO, where the user doesn't have to login a second time in the secondary app. If he has already login in the main application and has an active session there, this secondary web application should be automatically logged in as well (via browser session/cookie information?).
As I am not a specialist with IDPs and SSO, I am struggling to find the right approach to this. So here are some question i hope someone can answer:
All reactions