Skip to content

OAuth / SSO / Identity Provider#

Problem statement (interviewer prompt)

Design an OAuth2 / OIDC identity provider that other apps integrate with for single sign-on. Cover the authorization code + PKCE flow, refresh + access tokens, JWT vs opaque tokens, session management, social login federation, and multi-factor auth.

flowchart LR
  U([User])
  APP[App]
  IDP[Identity Provider]
  TOK[Token]
  U --> APP
  APP --> IDP
  U --> IDP
  IDP --> TOK --> APP
  APP --> U

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class U client;
    class APP,IDP,TOK service;

flowchart TB
  subgraph User
    BR([Browser])
    NATIVE[Native app]
  end

  subgraph Client[Client App / Relying Party]
    APP[App backend]
    SDK([SDK])
  end

  subgraph IdP[Identity Provider]
    AUTHN[AuthN: pwd, MFA, passkeys, biometrics]
    CONS[Consent screen]
    SES[Session / SSO cookie]
    AUTHZ[AuthZ / claims]
    JWKS[JWKS public keys]
    ROTATE[Key rotation]
    LOGOUT[SLO single logout]
  end

  subgraph Flow
    AC[Authorization Code]
    PKCE[PKCE for native / SPA]
    CC([Client credentials])
    DEV([Device code])
    REFRESH[Refresh tokens]
    REVOKE[Revocation endpoint]
  end

  subgraph Tokens
    AT[Access token JWT]
    IDT[ID token OIDC]
    RT[Refresh token]
    TI[Token introspection RFC 7662]
  end

  subgraph SAML
    SP[SP-initiated SAML SSO]
    META[SAML metadata]
  end

  subgraph Provisioning
    SCIM([SCIM user provision])
    JIT[Just-in-time provisioning]
  end

  User --> Client --> Flow --> IdP
  IdP --> Tokens --> Client
  Provisioning --- IdP
  SAML --- IdP

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class BR,SDK,CC,DEV,SCIM client;
    class NATIVE,APP,CONS,SES,AUTHZ,JWKS,ROTATE,AC,PKCE,REFRESH,REVOKE,AT,IDT,RT,TI,SP,META,JIT service;
    class AUTHN,LOGOUT obs;
  • Web app: Authorization Code + PKCE (RFC 7636).
  • Native: same, system browser.
  • M2M: Client credentials.
  • Device with no browser: Device authorization grant.

Tokens#

  • Access tokens: short-lived (5-60 min), JWT or opaque.
  • Refresh tokens: longer-lived, sender-constrained (DPoP/mTLS) ideal.
  • ID tokens (OIDC): identity assertions for the client.

SSO#

  • One IdP session → multiple apps sign in.
  • Logout (SLO) is hard; bypass via short-lived ATs + revocation.

Glossary & fundamentals#

Concepts referenced in this design. Each row links to its canonical page; the tag column shows whether it is a high-level (HLD) or low-level (LLD) concept.

Tag Concept What it is Page
HLD Observability metrics, logs, traces, SLOs observability
HLD Service mesh sidecar mesh, mTLS, traffic policy service-mesh

Quick reference#

Functional#

  • Issue and validate access tokens (OAuth 2.0).
  • Identity assertions (OIDC).
  • Multi-app SSO + SCIM provisioning.
  • MFA, passkeys, social logins.
  • Token revocation.

Non-functional#

  • p99 token endpoint < 200 ms.
  • 99.99%+ availability - IdP outage breaks everything.

Trade-offs#

  • JWT scales because verification is offline; revocation harder.
  • Opaque + introspection centralizes auth state; latency cost.
  • Symmetric vs asymmetric keys: asymmetric mandatory if trust boundary crosses orgs.

Refs#

  • OAuth 2.0 RFC 6749, OIDC core spec.
  • "OAuth 2.0 Threat Model" RFC 6819.
  • "OAuth 2.1 BCP" current best practices.
  • Auth0 / Okta / Cognito docs.

FAQ#

How does the OAuth2 authorization code flow work?#

The client redirects the user to the IdP, the user authenticates and consents, the IdP returns a short code, and the client exchanges the code at the token endpoint for access and refresh tokens.

Why use PKCE in OAuth?#

PKCE prevents code interception in public clients. The client generates a random verifier, sends its hash with the auth request, and only the original holder of the verifier can redeem the code.

JWT vs opaque access tokens?#

JWTs are self-contained and stateless: services verify signature locally. Opaque tokens require an introspection call to the IdP but can be revoked instantly. Pick based on revocation needs.

How does refresh token rotation work?#

Each refresh issues a new refresh token and invalidates the previous one. If a leaked token is reused after rotation, the IdP detects the reuse and revokes the whole token family.

How does SSO work across multiple services?#

The IdP holds a single sign-on session cookie. When a user hits service B, it redirects to the IdP, which sees the active session and issues a token without prompting for credentials again.

How is multi-factor auth integrated?#

After password validation the IdP enters an MFA step requesting TOTP, push, or WebAuthn. Only after MFA success does it issue the auth code or token.

Video walkthrough

SSO Explained: OpenID, SAML & OAuth : via ByteByteGo