Single Sign-On

a511e72a-a566-4e3c-a5dc-d6cb0996f3ab

Single Sign-On

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0001

Effectiveness0.000

Connections

22 linked nodes

PERTAIN_TOProblem

Each application should gets its own token for data access. Tension: with its own access to resources.

PERTAIN_TOProblem

Avoid passing tokens in URLs. Tension: tokens can leak to logs and be exploited.

PERTAIN_TOSolution

Another possible option, if you cannot achieve SSO in a standard way — safe to pass in URLs since they have a very short lifetime and can only be used once. Tension: These are safe to pass in URLs since they have a very short lifetime and can only be used once. Outcome: This type of solution usually requires you to to customize the login flow for Site B.

PERTAIN_TOSolution

Ideally, use a standard protocol like OAuth 2.0 and OpenID Connect — where an authorization server provides single sign on capabilities. Tension: to enable the above.

PERTAIN_TOProblem

Is it a good idea to make a call to the authorization service for every request? — a "one-per-request" filter to the main service. Tension: to call the authorization service, check the JWT, and get user information from it. Outcome: in the future, to all other services.

PERTAIN_TOProblem

How can I get the authenticated user in the main service? Tension: In a monolithic application, I would save it in the SecurityContextHolder in a "one-per-request" filter. Outcome: Should I add a "one-per-request" filter to the main service.

PERTAIN_TOProblem

there is an endpoint in the main service that needs to be secured not only by a valid JWT — in the main service. Tension: but also by the roles that the authenticated user has. Outcome: configure secured endpoints for each service?

PERTAIN_TOSolution

the information about the user is inside the JWT — other services does not need to call the authorization service or database. Tension: this token is signed from the authorization service but other services does not need to call the authorization service or database. Outcome: they only need a shared secret they use to check the validity of the token.

PERTAIN_TOProblem

A SPA calls a backend API (B) which must call another downstream API (C) on behalf of the signed-in user. The question is how to pass/obtain appropriate tokens so B can call C without unsafe or inappropriate token handling (e.g., forwarding an identity token).

PERTAIN_TOSolution

Use OAuth’s downstream API/on-behalf-of flow so B exchanges the incoming user token for a new access token targeted for C (with required scopes/audience), then use that token when B calls C.

PERTAIN_TOProblem

does not work when I follow the instructions — Solr 9.5 standalone.

PERTAIN_TOSolution

Finally succe. Follow the instructions provided in the Apache Solr official documentation for setting up the Basic Authentication Plugin. — Create a security.json file and populate it with the provided JSON configuration. Outcome: Once the security.json is properly set up, start Solr and access it via the web interface.

PERTAIN_TOProblem

Uncertainty whether an authorization code in a native app should be exchanged for an access token client-side or backend-side, and whether the resulting external access token can be used to authorize calls to the app's own Web API.

PERTAIN_TOSolution

Perform the authorization-code-to-token exchange in the backend to keep tokens and the client secret off the client. Create/establish an app-specific user session (e.g., HTTP session cookies or tokens) and do not use the external provider access token directly for your backend authorization; generate/validate authorization specific to your APIs.

PERTAIN_TOProblem

How does `az account get-access-token --resource api://<appid>` retrieve an access token when the Azure CLI app itself does not appear to have permissions/scopes for the target application and no middle-tier API is present for an on-behalf-of flow.

PERTAIN_TOSolution

Use MSAL to acquire the access token in the context of the signed-in user as a public client, requesting scopes for the specified `api://<appid>` (target app registration/resource). The resulting Bearer token is then used to call the protected API.

PERTAIN_TOProblem

I can pass user id through a query string — When consumer click on the "dashboard" link on Mobile App. Tension: how can I make them sign in to our Web app without going through another Login screen. Outcome: I have read a bit about SSO, is that right direction I am thinking towards?

PERTAIN_TOSolution

To enable SSO, users must login via the same IDP — The general login flow is App to Authorization Server (AS) to Identity Provider (IDP). Tension: users must login via the same IDP, though they can use a different AS. Outcome: An advanced option is for the source mobile application to issue a nonce at the target application's AS, then pass the nonce to the web app.

PERTAIN_TOProblem

handling endpoint authentication of Entra to custom SCIM endpoint. Outcome: And I can't understand why this line was added.

PERTAIN_TOProblem

Whether using separate SSH keys is necessary for SSH authentication versus SSH/Git data signing, and if reusing one key for both purposes is secure.

PERTAIN_TOSolution

You can use a single SSH key for both authentication and data signing because both are digital signatures and OpenSSH uses domain separation to prevent confusion. Use separate keys when you need longer-term signing keys (e.g., less frequent rotation) or when signing keys are stored on stronger hardware like a YubiKey while authentication keys are not, and ensure signing keys are protected for long-term verification.

PERTAIN_TOProblem

React frontend never sees the authorization code and the code remains undefined

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Single Sign-On - inErrata Knowledge Graph | Inerrata