Transitioning to an SSO platform #6339

7 Answer(s)

• 

  0

  liangshiwei created 4 months ago

  Support Team Fullstack Developer

  I read something about the use of external logins on the Auth Server

  I think it should be working. have you give it a try?

  Save Cancel
• 

  0

  auxo-devsu created 4 months ago

  I read something about the use of external logins on the Auth Server

  I think it should be working. have you give it a try?

  Thanks for looking into my ticket but, as I said, I would like to have an actual single sign-on solution and let a single identity potentially have access to multiple tenants, as that's something very common in our industry.

  Could you please give me some instructions on what things I should do and consider to make this happen?

  Save Cancel
• 

  0

  maliming created 4 months ago

  Support Team Fullstack Developer

  hi

  You can try to replace AddOpenIdConnect with auth0 in the MVC project. It's simple.

  let a single identity potentially have access to multiple tenants, as that's something very common in our industry.

  You can change the current to access the data in other tenants.

  https://docs.abp.io/en/abp/latest/Multi-Tenancy#change-the-current-tenant

  Save Cancel
• 

  0

  auxo-devsu created 4 months ago

  Thanks @maliming!

  Would you have any examples of how to replace AddOpenIdConnect? If I manage to replace that with Auth0, do I still have to keep the ABP's Identity Server alive?

  Save Cancel
• 

  0

  maliming created 4 months ago

  Support Team Fullstack Developer

  hi

  The ABP's identity module will exist in the API project.

  https://auth0.com/blog/exploring-auth0-aspnet-core-authentication-sdk/

     Auth0
  Web     API
       
  

  Save Cancel
• 

  0

  auxo-devsu created 4 months ago

  Thanks for the link! I had seen that bit already.

  Authenticating with Auth0 will be fine, I'm sure. Still, I'm looking for guidance on how to use a 3rd party but also continue to leverage ABP's authorisation bits like permissions, roles, current tenant identification and all that.

  Could you please help me with that? What are the things that will break into ABPs authorisation system when I decide to not use the out-of-the-box auth server? What are the things to be replaced/re-written/extended?

  Save Cancel
• 

  0

  liangshiwei created 4 months ago

  Support Team Fullstack Developer

  Hi,

  You can use the external login and disable the local login.

  https://docs.abp.io/en/commercial/latest/modules/account#install-a-new-external-login https://docs.abp.io/en/commercial/latest/modules/account#local-login

  For SSO, you can configure the shared cookie domain:

  https://learn.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-8.0

  for example:

  context.Services.AddAuthentication(options =>
  {
      options.DefaultScheme = "Cookies";
      options.DefaultChallengeScheme = "oidc";
  })
  .AddCookie("Cookies", options =>
  {
      options.Cookie.Name = ....;
      options.Cookie.Domain = ....;
  
      .....
  })
  

  Save Cancel