What I want to achieve?

To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only sent to their servers.

The idea

On client app, when submitting login form (which also has Domain input), request is sent to certain Authentication server where client can login with their credentials. Server generates JWT with their own Domain Secret. That Token is returned to client app and then it is used to access Resource Server. That server has all the secrets in the database linked to the Domain so it can validate Tokens.

The question

Is this secure? Is there better way to achieve this?

  • Are there trusts established between these domains? Do you have control over servers on these other domains? – PwdRsch Apr 12 at 16:28
  • I do not have remote control on those servers. – wast Apr 15 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.