We have a single-page web application, and we have a new SSO site (also our own) using OAuth2, and are looking to hook them up.
On our production/staging/CI deployments, it's easy to hook everything up. For instance:
- on production we'll have
https://app.company.comaccess our prod backend point to
https://sso.company.comfor auth and vice versa
- on CI we'll have
https://app.ci.company.comaccess our dev backend and point to
When we're doing development on the app, we access it locally at something like
http://localhost:8000/, and it points to the shared dev backend. In the past, we've had it just do its own auth against the dev backend (getting the end user's credentials and submitting it), but we'd like to get it wired to use SSO to auth.
The question comes up of how we can do this without every developer who wants to develop locally needing to set up and custom configure their own SSO service. Specifically, can we use the shared dev/CI SSO and have it point to our local deployments?
What we've considered:
- Use a proxy file/hosts file and have
http(s)://localhost:8000. This burdens us with setting up HTTPS locally or have the SSO direct to a non-HTTPS URL. Also, the setup is a bit of a pain.
- Have our local app redirect to the SSO with an argument identifying itself, and have the SSO use that to know where to redirect. For instance, redirect to
https://sso.ci.company.com/?appUrl=localhost:8000. This forces us to punch an open-ended redirect in the SSO that we'd have to turn off for production and it is a bit "weird" but it works and can be black-boxed into the app.
- Just run the SSO locally on every dev box. This is basically the non-solution since it would require a lot of setup to get to a "one box that can run everything" script, and it negates one of our valuable advantages at the moment in that basically all you need to do is check out the code on any system and have it running. I've seen this done before commonly though (often on top of dev VMs); I would just like to explore options that we are potentially closer to.
Is there a solution to this sort of problem or aspects of our ideas we haven't considered yet?