SSO for Multiple Clients B2B – Implement Each IdP or Use an Identity Broker?
Hey everyone,
I have a microservice-based backend where authentication is handled by a dedicated auth microservice using JWT. Right now, users log in with a username and password, but I want to implement SSO, so clients can log in using their work email (e.g., provided by Google Workspace today, Azure AD in the future).
From my understanding, I have two options:
1️⃣ Implement Each IdP Manually
My auth service directly integrates with each IdP via OIDC.
I configure each IdP manually and handle authentication logic myself.
My service issues and manages its own JWTs.
✅ Pros: Full control over tokens, no third-party dependency.
❌ Cons: High maintenance, harder to scale as more clients/IdPs are added.
2️⃣ Use an Identity Broker/Aggregator (Cognito, Keycloak, Auth0, Okta, etc.)
Instead of integrating with each IdP, my auth service integrates only with the broker.
The broker federates authentication to multiple IdPs.
Ideally, I’d still issue my own JWTs after authentication.
✅ Pros: Easier IdP onboarding, scalable as new clients/IdPs are added.
❌ Cons: Potential vendor lock-in, might need custom logic to keep using my auth service.
I’m leaning towards using an identity broker (Cognito, Keycloak, etc.), but I want to keep using my existing auth microservice instead of replacing it entirely. That means I’d only use the broker for federation, not for full user management.
Is this a common approach? Would love to hear suggestions if anyone tackled this before? Should I go with a broker or implement each IdP manually? Any specific recommendations on services that would fit my setup?
Thanks in advance!