title: Use openid connect as SSO for multiple applications
body: <p>I am trying to use openid connect to create a SSO for my application.</p>
  <p>Basically we have one API layer and different Apps (clients) will consume the service of this layer.</p>
  <p>To start with we added OAuth2.0 for authorization for each of the different apps; for authentication we are currently using our own database (IDP)</p>
  <p>We want to the end users to have a single sign on experience for this flow.
  To have that we added openid on top of the OAuth flow we have built.</p>
  <p>The web server has the standard oauth + openid implementation and has the following</p>
  <ul>
  <li>Explicit Flow</li>
  <li>Implicit Flow</li>
  <li>Password Grant</li>
  </ul>
  <p>On adding the openid connect, the server now has the ability to send the id_token (jwt) as well, depending on the scope and request type</p>
  <p>There are two clients registered (C1 &amp; C2)</p>
  <p>Step 1: C1 follows explicit flow and uses response type as code, so when a user (U1) access C1 it is redirected to the authentication server where U1 enters the credentials.</p>
  <p>Step 2: The authorization server validates the credentials and prompts for the user consent, confirming which sends out the code to the redirect_uri of C1</p>
  <p>Step 3: C1 then requests for a token and the server gives out an access_token and an id_token; the access token being persisted in the database</p>
  <p>Step 4: U1 now needs to access C2</p>
  <p>Questions:</p>
  <ul>
  <li>What would be the best way/practice for C2 to get the access token from the api sever without having the user to login again.</li>
  <li>If C1 passes the jwt id_token to C2 through local-storage or any other means, one possible way would be to exchange the id_token for an access_token following <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-token-exchange-12" rel="nofollow noreferrer">this</a>.</li>
  <li>If we go with the above approach, would it be sufficient to just verify the id_token and issue the access_token or should we add any other check</li>
  <li>Any other approach.</li>
  </ul>
  <p>Thanks</p>