authentication - JWT token for multiple websites

Question

How can I have a single JWT token be shared among multiple websites. I assume that the first thing would be to have the same secret on all websites.

If user logs in on site A and a token is generated I want to use the same token for website B on a totally diferent domain.

Can it be done?

Answer 1

What you want can be done, but not with a single JWT token. A JWT token is intended for a certain service or application indicated by the audience (aud) claim. You cannot use the same token for another application or service.

What typically happens to make your SSO scenario work, it that the user logs in to the token issuing (authorization) server. As long as that session is valid, the user can acquire tokens for all applications the server can issue tokens for.

So, when the user logs in to the first application, the authorization server sets a cookie to establish a session. When the user navigates to the second application, the application redirects him/her to the authorization server for authentication. The authorization detects the session cookie and does not prompt to user to log in again, but issues a new JWT token for the second application.