Can't able to achieve SSO for multiple domains

Question

I have demo web application.
The domain name for this is demo.company.com
Once I log in to this application I can access the other 3 applications. those 3 application's domain names are
1.demoapp1.company.com
2.demoapp2.company.com
3.demoapp3.company.com

But the problem I'm facing here is after I login to main web application (demo) if I trying to access demoapp1 it is prompting for consent.

I should be able access all other 3 apps after I login to demo, in my case it is not happening.

We are using openID protocol for SSO.

could u guys help me with this? stuck with this problem for 3 days

Using java-play web application. security library is pac4j.

For all the apps : tenantID , clientID and secretID are same.

Answer 1

Hi @Raghavendra · Thank you for reaching out.

I can think of 2 reasons for this issue:

1. Please check if your authentication request includes prompt=consent parameter, when this parameter is passed, users are prompted with a consent prompt each time they access the application. Ref. https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.prompt?view=azure-dotnet
2. The application might be requiring permissions which require admin consent. Please use below url to grant admin consent for entire organization/tenant:
   https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id={client-id}

If the users are getting consent prompt only at the initial sign-in and not afterwards, it must be due to the requirement of user consent. This depends on what permissions you have included in the scope parameter of your authentication request. For certain scopes, user consent is required. If this is the case, follow step 2 that I have shared in my answer above. Users will not be required to provide consent as admin has already provided consent for entire organization.

If users are repeatedly getting consent prompt, even after consenting, you must update your code to not include prompt=consent in the request.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.