I am relatively new to web development and using auth0 hence why I cannot get this to work.
Recently I have secured both our webapplication running an instance of R-Shiny and a wordpress website with auth0. I managed to share the database connection but I would like to see that if you are logged in at one application, you are also logged in at the other application. Given that they share the same client ID/secret and they have access to the same database, how can I make sure that if you are logged in at one application you are also logged in at the other application?
As long as you have a single Auth0 tenant, both applications defined in that tenant, and both applications using the same DB connection, you should get the SSO behavior you are looking for.
I have turned off one of the two databases:
![db_auth0|690x170]
Both applications still work (I can login at each application seperately) and when I manually inspect the url when trying to log in on either, the client ID is the same for both applications.
The SSO behavior I am looking for does not occur, I have to login at each application separately.
Perhaps I misunderstand the concept of “single Auth0 tenant”, please correct me if I am wrong, does a single Auth0 tenant imply that they are both registered under 1 application? As in, that they both use the same client ID and secret? I entered the same client id and secret both in the wordpress configuration and the auth0 configuration file for the R application. The wordpress website and the R application are located at two different servers, I am unsure if that is relevant to solve this issue.
I would love to hear how I can go about solving this issue, I am simply unsure where to look and what to google to solve the issues I encounter.
Each application should have its own client ID and secret.
SSO is driven by a cookie in the Auth0 tenant domain - are you sure your cookie settings are appropriate and both applications see the session cookie?
I’d suggest logging in using the raw URLs from Auth0’s authentication API (the /authorize endpoint) - you can figure out the parameters by watching the network while logging in to either app, and seeing if SSO works there, trying different browsers etc.