4 ms·
> Now, their employees can securely access Ghost Land at ghost-land.sso.pacworld.com That’s the part I’m confused about. They force all sites that need SSO to
by Lx1oG-AWb6h_ZG0 8y ago
> Now, their employees can securely access Ghost Land at ghost-land.sso.pacworld.com
That’s the part I’m confused about. They force all sites that need SSO to be under the same subdomain. If they can share the same session cookie, why does each microservice need to redirect at all? Can’t they all use the same oauth app underneath?
- Buge 8y agoOne possible reason is they might want each microservice to be a separate security domain. So that if one microservice is compromised, attackers cannot use credentials stolen from that microservice to control other microservices.
- X-Istence 8y agoThere is no requirement for all of them to be under the same domain. It's not made clear in the article, but the documentation shows how you can run all of them under different domains too.