search

Drenso / symfony-oidc

This project contains the Symfony OIDC bundle, which is directly based on https://github.com/jumbojett/OpenID-Connect-PHP
Apache License 2.0
54 stars 32 forks source link

Question about cross-origin authentication #33

Closed acjbizar closed 1 year ago

acjbizar commented 1 year ago

First of all, pardon my ignorance on this subject. Any pointers in the right direction would be appreciated.

The scenario is that I have an existing Symfony (6.2) application that has a working authentication mechanism using the now native User Entity that talks to a self-hosted database. The application is a single instance that spans multiple domains (say A.com and B.com), which is handled by routing. The form_login resides on one of said domains (say A.com/login). So far so good.

Now what I want to achieve is that if a user has successfully authenticated with the form on A.com/login, and then after visits B.com, they should automatically be authenticated on B.com. I figured I should be able to do this by introducing OpenID Connect, and that is how I stumbled upon this bundle, but perhaps that was misguided?

I installed and configured the bundle, including a custom UserProvider and a controller with a checkLogin. This appears to work as intended, because when I visit B.com/login_oidc, it redirects me to A.com/login, and there the user can authenticate. What I fail to understand, however, is how I get B.com to automatically check the authentication status with A.com, and then authenticate the user on B.com accordingly.

I’m sure I’m missing a step, but I’m not sure of the magnitude of this step, ranging from just missing a configuration/setting, to having entirely missed the point of this bundle. Would anyone be so kind as to indicate if this bundle at all helps with what I’m trying to archive, and in any event point me in the right direction? Thanks in advance, as this would be greatly appreciated.

bobvandevijver commented 1 year ago

You're missing the Identity Provider (IdP) step, i.e. the server part that handles the actual authentication. Your project will need to act as both a Service Provider (SP) on B.com and as IdP on A.com. This bundle only implements the SP part; you can try https://github.com/thephpleague/oauth2-server-bundle for the IdP part.

acjbizar commented 1 year ago

That makes sense. I will get on it. Thanks for your blazingly fast response!