This document is not finished. When finished remove read restrictions.
This tutorial goes through a SSO setup process. This is intended for developers and administrators configuring external websites where they want users who are logged in at one site, to go to another site, and be visible already logged in without the need to click a “sign in” link at all. All such sites must already support normal OpenID Connect login process.
Pre-requirements
You have multiple websites which already use normal OpenID Connect authorisation process to allow user sign-in.
Goal
You want to avoid users needing to click “sign in” when they arrive at a new site.
User goes to site 1.
User logs in at site 1.
User goes to site 2 for the first time.
User appears to already be signed in at site 2 without the need to interact with the UI.
How this works
The goal is made possible by having the user’s browser make a request to site 2 during site 1’s authorisation process. During this request site 2 receives a token which it can use later to have the user sign in without interaction. Site 2 should set a cookie to the browser, which it will read later when the user arrives at site 2 for the first time. When this happens, site 2 redirects the user to the OpenID Connect authorisation URL with the token parameter included. If the token is valid, the user will authorise site 2 and is redirected back without interaction.