I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites and we also spend alot of time removing accounts when customers no longer need access.

I would like users to register for Site A. After successful authentication; a user can click on a link within the site to access Site B but without the user entering credentials. I want Site A identity to be used to access site B and its resources. I do not need site B resources to be presented on Site A site, but simply allow users to access site B if already authenticated to site A.

Users may have different roles on site B.

What is my best option? Oauth2 sounds like a good option. But will it satisfy my requirement above?

Who will manage the authorisation server? I presume Site B?

Thank you.

  • 1
    I think you need to start with the SaaS, and see what they support. Can they act as the identity provider? If so, what can they support? Can they act as a service provider? If so, what can they support? I will say that because you're trying to share identity data that you're really limited to OIDC and SAML - OAuth isn't about transmitting identity data.
    – Andrew K.
    Commented Aug 19, 2020 at 12:57

1 Answer 1


OAuth2 is a framework for authorization, if your request is about the identity of the users then you should consider using OpenID which is part of the global framework OAuth2, but for a special use case: authorize access to the identity.

As for SAML, you can configure one of your servers as identity provider and the other as service provider, but the hard part will be assigning different roles for the different servers A and B.

OpenID can be more easy to use when you have roles or scopes to exchange, you should install an SSO solution (like openam, gluu, keycloak) on your server A, users will be redirected to authenticate, and their session will be valid for server A (or a seperate server), as for server B an OpenID request is sent by server A to server B, which will contain a request for authenticating the user, with scopes relative to server B, for example:

  curl -k --data "grant_type=password&password=1234&client_id=app-profile-vanilla&scope=scope_sever_B&username=100000&client_secret=578262e1" http://localhost:8180/protocol/openid-connect/token

Result: {"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJCaTM1c2VPQTh4c290bzQ5eTMwTXNpNVZ6MW...","expires_in":60,"refresh_expires_in":1800,"token_type":"bearer","scope":"email profile scope_server_B"}

This example is just to demonstrate how its works, in your environment you should use authorization code flow, which is the default flow for a user, and since the user is already authenticated to server A, the authorization server will pick its session and created another one for server B, without the user having to do anything.

Another advantage of using OpenID is that in case you wanted to add more sites, the configuration to include them in the sames process would be very easy (create an OAuth2 client, configure scopes, configure the new server), which is relatively easy compared to SAML2 integration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .