Hello All, I'm looking to implement SSO kind of feature with my APIs So basically i have a requirement where we have few APIs, and those APIs should be accessible from our authenticated clients. Like on single singin they can also access our APIs but with full authentication & security. Can anyone please suggest/guide me the best way to achieve this implementation. Thanks in advance

We are doing somewhat similar with OAuth 2.0 token All API will be in a folder with application.cfc file OnRequestStart() - Validate the token for its security and authority before calling the actual API

have a look at https://www.keycloak.org/ and I would recommend OpenId Connect rather than straight OAuth2 as the concepts are better defined

Thanks for the reply guys

@Angad Yadav: No idea of SAML connecting with the CF API

you can use SAML with keycloak, but with cf you will need to fall back to java. you could create a token and pass it with the saml response but it is a whole heap of nasty over and above OAuth/OIDC

@thisOldDave Okay thanks for the suggestion, i'll try and ask if anything needed