I have the following architecture:
- login.example.com - an authentication service with a stateful backend that can auth users for multiple apps
- app1.example.com - a SPA that calls a stateless API, app1-api.example.com
- app2.example.com - a SPA that calls a stateless API, app2-api.example.com
I want users to be able to start at login.example.com and then based on the kind of user they are, be redirected to either app1 or app2 with an appropriate API access token.
I envisioned this as essentially an OIDC flow. After authentication, login.example.com would redirect to app1 with an auth code:
https://app1.example.com/?code=abc123
app1 would then exchange the auth code for an access token:
POST https://login.example.com/token/
{
"code": "abc123"
}
The problem I'm running into is that I know PKCE is now recommended, but as best I can tell, implementing PKCE would require the user to start on app1.example.com so that a code challenge could be generated and stored in LocalStorage there, before being redirected to the login service. So my question is:
Is there a way to securely get an access token from login to app1 or app2 when the flow is initiated at login?
EDIT 2022-09-16 It seems that Auth0 states pretty unequivocally that this can't be done without introducing some security risk:
IdP-Initiated flows carry a security risk and are therefore not recommended. The recommendation is to use SP-Initiated flows whenever possible.
I guess I'm going to need to explore other architectures.