Integrate apps with tenant-scoped OIDC.

Tenant-aware Single Sign-On

OpenIssuer provides SSO through OpenID Connect. Register each application as an OAuth client under the tenant issuer, and users can authenticate once before accessing multiple connected applications. OAuth2 handles delegated authorization; OIDC supplies the signed identity and session claims.

Live two-app SSO showcase

The Summit tenant currently backs two separate OAuth clients: OpenIssuer Workspace and OpenIssuer Reports. Sign in to either app, then open the other app. Summit reuses the existing issuer session, while each app still creates and protects its own local NextAuth session.

Try the Workspace → Reports flow

1. Open Workspaceand sign in with the Summit tenant.
2. Select OpenIssuer Reports from the active-session notice.
3. Reports redirects through Summit and returns signed in without asking for credentials again.

This is SSO, not shared application credentials: each client has its own redirect URI, secret, tokens, and app session. Signing out of one app does not automatically erase the Summit issuer session or the other app's cookie.

The showcase depends on the summit issuer and dedicated namespace. Infrastructure changes to other tenants should not affect either SSO app; verify the shared TLS certificate after changes because it covers multiple tenant and application hostnames.

Integration flow

1. Choose the tenant issuer URL for the customer or environment.
2. Register an OAuth client in that tenant admin portal.
3. Add the application callback URL to the client registration.
4. Configure the app with issuer, client id, client secret, and scopes.
5. Start the authorization code flow with openid and profile scopes.

NextAuth quickstart

Use the maintained example client to validate an OpenIssuer tenant from OAuth client registration through token and session inspection.

1. Create an OAuth client in the tenant admin portal.
2. Register the callback URL ending in /api/auth/callback/myauth.
3. Configure the issuer, client id, client secret, and NextAuth secret.
4. Deploy the app and verify the issuer and tenant claims in the session.

Admin portals

Tenant admins use the admin portal to manage OAuth clients, users, organizations, roles, and default organization access.

Deployment model

OpenIssuer supports both a shared multi-tenant deployment and a dedicated deployment for a business or entity. Both use standard host-based OAuth2 and OIDC issuers; the difference is where application workloads and service databases run.