Skip to main content

CrossDomainSsoUser

User-level cross-domain SSO via auth.codebase.how broker β€” unifies internal multi-domain SSO + B2B SAML/OIDC + Social OAuth.

Status​

KeyValue
Layercore
TierL1
Statuswip
Version0.3.0
PriceFree (free)
CategorySecurity & Auth

Overview​

Overview​

CrossDomainSsoUser is the end-user cross-domain SSO plugin for multi-saas-kit (ADR-042). Distinct from ExternalSsoModule (outbound to external OSS) and ADR-040 (Platform Admin admin-jump).

Scenario​

User signs in at voca.how, navigates to academy.how β†’ auto-authenticated. Standardizes SSO flow across SaaS sharing the same operator.

Architecture​

  • Broker: auth.codebase.how (independent project)
  • Abstraction: IdentityProviderInterface + SsoTokenServiceInterface (Core)
  • Data split: user master in client SaaS DB; SSO operational data in broker DB; external_identities mapping in client SaaS DB.

Phased Provider Support​

  • Phase 1: InternalSsoProvider (msk-internal pool)
  • Phase 2: SAML / OIDC (B2B)
  • Phase 3: Google / Kakao / Apple OAuth

Security​

  • 256-bit nonce + cache lookup (avoid JWT pitfalls)
  • One-time authorization code (TTL 60s)
  • return_url allowlist + state CSRF
  • Back-channel logout (Phase 1.2)
  • Full audit trail

License​

MIT

Demos​

πŸ›’ View on Plugin Store: store.codebase.how/plugins/cross-domain-sso-user