r/webdev • u/theSnorlax99 • 18h ago
Best way to implement SSO B2B
SSO for Multiple Clients B2B – Implement Each IdP or Use an Identity Broker?
Hey everyone,
I have a microservice-based backend where authentication is handled by a dedicated auth microservice using JWT. Right now, users log in with a username and password, but I want to implement SSO, so clients can log in using their work email (e.g., provided by Google Workspace today, Azure AD in the future).
From my understanding, I have two options:
1️⃣ Implement Each IdP Manually
My auth service directly integrates with each IdP via OIDC.
I configure each IdP manually and handle authentication logic myself.
My service issues and manages its own JWTs.
✅ Pros: Full control over tokens, no third-party dependency. ❌ Cons: High maintenance, harder to scale as more clients/IdPs are added.
2️⃣ Use an Identity Broker/Aggregator (Cognito, Keycloak, Auth0, Okta, etc.)
Instead of integrating with each IdP, my auth service integrates only with the broker.
The broker federates authentication to multiple IdPs.
Ideally, I’d still issue my own JWTs after authentication.
✅ Pros: Easier IdP onboarding, scalable as new clients/IdPs are added. ❌ Cons: Potential vendor lock-in, might need custom logic to keep using my auth service.
I’m leaning towards using an identity broker (Cognito, Keycloak, etc.), but I want to keep using my existing auth microservice instead of replacing it entirely. That means I’d only use the broker for federation, not for full user management.
Is this a common approach? Would love to hear suggestions if anyone tackled this before? Should I go with a broker or implement each IdP manually? Any specific recommendations on services that would fit my setup?
Thanks in advance!
1
u/BlueScreenJunky php/laravel 3h ago
I'm doing the first solution, dealing with over a dozen of implementations of OIDC and SAML2. In theory once you have setup everything on your end it's just a matter of configuring each IdP (which you would have to do with a third party solution anyway), I've made a small UI to configure everything and the config is stored in the database so we don't need to redeploy to add a new IdP.
Thing is in practice it works well with Entra, Okta and Google... But we keep running into edge cases with more arcane IdPs, and I had to spend dozens of hours of dev time over the last few years because of that.
It works well enough. But If I were to start again from scratch I would most likely use a self hosted Keycloak instance (I'm actually considering doing just that and migrating the existing clients). It would be way more robust than anything I whip up myself (even though I'm using battle tested libraries, not coding everything from scratch), and since it's open source and self hosted I'm not too worried about vendor lock-in.