0

I am in the process of building an integration between 2 service providers (SP). I have setup my own Identity Provider, KeyCloak.

What I am trying to achieve is as follows: A user signs into SP1 using SSO, they get redirected to our IDP to sign in. They sign in successfully and are redirected back to SP1. Within SP1 a user can access SP2 via a link. I want this user to be automatically signed into SP2 instead of having to re-authN themselves.

I am attempting to implement this solution using KeyCloak as my IDP and SAML as the authentication mechanism. However, I am currently stuck on the following: how does SP2 get informed that a valid and authN'd user is being sent there by SP1? Is there some sort of SAML file that must be shared? How does SP1 go about sharing this information with SP2?

Improve this question
4
  • 2
    The best practice is both SP should manage their own user session as you cannot share session cookies with SP2 at different domain. If the user has already signed into Keycloak from SP1, when visiting SP2, the user won't have to sign into keycloak once again. Keycloak will immediately redirect back to SP2.
    – defalt
    Jan 27 at 13:18
  • Thanks for the clarity. What is the mechanism that will allow KeyCloak to do the auto-sign in? Is it a KeyCloak cookie that stores that session info?
    – dingo
    Jan 27 at 16:13
  • Welcome to the community. I think an OAuth Token is in play, but I'm not an expert in this field..
    – Sir Muffington
    Jan 27 at 16:27
  • Yes, Keycloak will recognize the user with its session cookie. If you have enabled the consent prompt, the user will not be immediately redirected back until the user gives the permission though.
    – defalt
    Jan 27 at 17:48

1 Answer 1

Reset to default
0

KeyCloak creates session cookies based on a user's login information and status. This can be used to provide authN when a user is redirected to the SSO login page after already having an active session - allowing them to be signed in (and grant consent) without having to re-enter credentials.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .