OIDC scenario with multiple resource servers

[Mak, Steven]

Hi OIDC plugin users,

I have this scenario and I'm not quite sure if our organization is doing things the right way or even if what we're doing is a really bad idea.

Please provide any feedback on this scenario and how we are trying to solve it.

Scenario:

I have App1 (primary app) and App2 that contain user-based data and they exist on different domains. We have integrated App1 via OIDC using a standard symmetric client secret and client id, enabled it for "authorization_code" grant type.

App1 will sometimes need to read or perform actions in App2. We have given the same OIDC symmetric client secret to App2, so App1 and App2 share an OIDC client id + secret, and enabled both domains in the redirect_uris array for this registration.

When a user asks App1 to read data from App2, it will start an OIDC flow and after use authN, get the access_token from our IdP and forward it to App2. App2 then uses the shared secret to "log the user in" by pulling the ID token and UserInfo token from the given access_token from App1. Then it will finish the request (outside of OIDC) by either sending the data back to App1 or performing the requested action.

My question is mostly: Is sharing an OIDC secret a bad idea? Are we using the wrong type of OIDC authentication or grant type? How should this be done? Is this a "two-legged" scenario?

I had
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250617/bd3156d7/attachment.htm>