SSO for multi-domain project #1248
-
|
Hey there, first of all thanks a lot for your implementations. I was searching for a headless IDP for a long, long time.. What we want to build is an ecosystem comparable to the one from atlassian (which are using auth0 I think). We are planning on using Ory Kratos as our IDP and a self service UI running on id.domain.tld. This will be our SSO login for all other services we build which may, or may not be subdomains of our original domain.tld. I read in #662 that this is currently not possible, so I want to ask you:
Thanks in advance for your time and effort! |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 2 replies
-
|
Hey there, glad you like Ory Kratos! :) So currently cross-domain is simply not possible for browser flows. What I wanted to do was to take the YouTube approach to cross-domain SSO but keep in mind that for every domain you add you also add a redirect. If you have thousands of TLDs you will go through thousands of redirects. The redirect can not be removed! It is required in order for the cookies to be set. If we talk about implementation, I think the first step would be to analyze and understand how YouTube achieves it (not in Chrome but e.g. Firefox!) or see if there is research on this topic. Then make a plan and implement it :) |
Beta Was this translation helpful? Give feedback.
-
|
Has anything changed with regards to this? Can we manage SSO between several domain names on the same Ory instance? If each domain needs its own Ory instance, then that doesn't seem like seamless SSO - unless I'm missing something. Thanks! |
Beta Was this translation helpful? Give feedback.
-
|
Hey @ditschedev |
Beta Was this translation helpful? Give feedback.
-
|
@vinckr Am I missing something? |
Beta Was this translation helpful? Give feedback.
Hey there, glad you like Ory Kratos! :)
So currently cross-domain is simply not possible for browser flows. What I wanted to do was to take the YouTube approach to cross-domain SSO but keep in mind that for every domain you add you also add a redirect. If you have thousands of TLDs you will go through thousands of redirects.
The redirect can not be removed! It is required in order for the cookies to be set.
If we talk about implementation, I think the first step would be to analyze and understand how YouTube achieves it (not in Chrome but e.g. Firefox!) or see if there is research on this topic. Then make a plan and implement it :)