We have several websites where users have to log in. For each website we want to support a single signon solution based on JWTs (JSON Web token).
There are also several (other) websites that can act as Identity Provider.
When the user accesses our website and is not authenticated, he can choose which identity provider he wants to use. The identity provider sends a JWT claim which in its simplest form says
{ "username": "john.doe" }
This is (hmac) signed with a shared secret so our website can check the authenticity of the claim.
In my situation a website can support multiple identity providers and an identity provider can work for multiple websites. All combinations have unique shared secrets.
My question is about how an identity provider can know which shared secret to use as it supports multiple websites. Would it make sense to request the identity with https://idp1.example.com?aud=mywebsite.com
where mywebsite.com is the website asking for identification.
The other way around I have a similar problem: when mywebsite.com receives a JWT how can it know which secret to use for verification. Would it make sense to ask the identity provider to include "iss": "idp1.example.com"
which can be used by mywebsite.com to find the secret to use?