Using Knock for SSO with multiple servers about knock

[nsarno]

No it's not needed! You also don't need to run the token_controller generator.

[nsarno]

Do I need to have the same 'secret' on both servers?

Yes. If you want to be able to decode a token generated by your auth server, you need to share a secret signature key.

This is the default configuration with Knock (see the initializer), you can change it to be anything you want.

 config.token_secret_signature_key = -> { Rails.application.secrets.secret_key_base }

I assume Knock would be running on the Auth server

Knock is conceived to act as both the API and the Auth Server. But you can also use it on both sides separately!

Here's an example of how to setup knock with Auth0 and a Rails API backend (that would be the Data API for you). In this case, Auth0 provides authentication as a service, so you don't need to care about implementing the Auth Server.

Hope this helps!

[andyrue]

Do you still need a User model that responds to authenticate on the API Backend or is that only if you don't use an external authentication source? I wasn't planning on having a User database on the backend, only passing group information in the JWT to determine specific access.

[andyrue]

Great, thanks for your help!