CODEWITHSUNDEEP
oauth-2.0idp
userx01233433
userx01233433

Reputation: 376

In OAuth 2.0 can Authentication server use IdP that is on different domain to authenticate Resource Owner?

What is the flow in such case? Assuming that I am using Authorization Code Flow for OAuth. How Authorization server can know if Resource Owner is authenticated?

Upvotes: 1

Views: 885

Answers (1)

Gary Archer
Gary Archer

Reputation: 29218

The flow is like this:

Client app redirects the browser to the Authorization Server (AS) at a URL such as https://login.mycompanycloud.com - using standard OpenID Connect - this is easily done by plugging in a library

The AS generally supports multiple authentication methods:

  • The client app is configured to use one or more
  • The AS can present a selection screen
  • Or the client app can send an acr_values query parameter to select one at runtime

The AS then redirects the browser to an 'authenticator', which can be an Identity Provider (IDP) in a different domain, eg https://login.mycompanyintranet.com

Domains used all need to be contactable from the user's browser, and the IDP needs to be able to send tokens to the AS. Due to trust configuration the AS can digitally verify tokens and treat the user as authenticated for the time period of the grant.

For an illustrated example, see my Federated Logins blog post.

Upvotes: 3

Related Questions