1

I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much information about this. If you could help me understand these doubts of concept, I would be very grateful.

Here's the context: WebApp-OpenID using SSO - Azure AD with no permissions or roles for users.

Please, correct me if I am missing something.

  • User came from our system and reach the vendor website (RP).
  • RP calls our Authorization endpoint to get the Authorization code - sending client_secret, client_id, application_id, redirect_uri, ... -
  • User reach our Authorization endpoint and... QUESTION: Are the user asked for credentials or are implicit in SSO?
  • Authorization code is granted and sent to the Redirect URI provided and registered.
  • RP wants to get the Access Token + ID Token from this user. Therefore, calls our Token endpoint using Client ID + Client Secret + Authorization Code and so on. MY QUESTION IS HERE: To get the Access Token, it is not necessary to send information about the user in the request? Does the RP get it from the browser directly? What information does the RP get to be sent?
  • Access Token + ID Token are sent to The Redirect URI registered.
Improve this question
0

1 Answer 1

Reset to default
1

Putting it as an answer to close it:
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/auth-oidc

Improve this answer
1
  • Please do not post link-only answers. Include the relevant parts of the link in your answer here.
    – schroeder ♦
    Apr 3 at 8:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .