Single Sign-On (SSO) Architecture

Ternis Auth powers a seamless Single Sign-On (SSO) experience across all applications, internal services, and partner sites in the Ternis network. Once a user authenticates on one Ternis property, they are recognized and automatically signed in across other interconnected applications without re-entering credentials.

1. How Ecosystem SSO Works #

The Ternis SSO architecture combines centralized session tracking with standard OpenID Connect authorization code flows:

[ Browser ]              [ Application A ]            [ Ternis Auth Central ]        [ Application B ]
     │                           │                             │                            │
     │ ── 1. Login to App A ───> │                             │                            │
     │ <─ 2. Redirect to Auth ── │                             │                            │
     │ ── 3. Authenticate with Password & 2FA ───────────────> │ (Session Created)          │
     │ <─ 4. Auth Code + Redirect to App A ─────────────────── │                            │
     │ ── 5. Logged into App A   │                             │                            │
     │                           │                             │                            │
     │ ── 6. Later: Navigate to App B (e.g. auth.thosted.de) ─────────────────────────────> │
     │ <─ 7. App B Redirects to /oauth/authorize ────────────────────────────────────────── │
     │ ── 8. Browser sends central session cookie ───────────> │ (Session Validated)        │
     │ <─ 9. Immediate Auth Code Redirect (No Password Prompt) │                            │
     │ ── 10. Logged into App B Automatically! ───────────────────────────────────────────> │

Key Advantages #

1. Frictionless Navigation: Users switch between tools (e.g. Ternis Git, Hosting Console on thosted.de, Developer Hub on ternis.dev) without interruption.
2. Centralized Credential Security: Passwords and 2FA credentials are never shared with or handled by individual client applications.
3. Instant Enterprise Revocation: Revoking a session in the Account Portal terminates access ecosystem-wide.

2. Hosted Cloud Services (auth.thosted.de) #

Ternis operates cloud hosting and managed SaaS under the thosted.de network.

auth.thosted.de functions as a trusted SSO gateway within the federation:

• Pre-authorized callback domains: All subdomains under *.thosted.de are whitelisted in the platform's redirect rules.
• Scopes pre-configured: Applications requesting openid profile email ternis:sso receive instant, zero-prompt authorization if the user already holds an active central session.
• Developers hosting apps on thosted.de configure their redirect URIs to https://app.thosted.de/sso/callback or https://auth.thosted.de/callback.

3. Silent Authentication (prompt=none) #

Single Page Applications (SPAs) and dynamic frontend dashboards can silently check whether the user is logged in to Ternis Auth without redirecting the user away from their current page.

The prompt=none Request #

Send an authorization request with prompt=none inside a hidden <iframe>:

<iframe 
  id="sso-silent-frame"
  src="https://auth.ternis.net/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fsilent-callback&scope=openid%20profile%20ternis%3Asso&prompt=none&state=xyz123"
  style="display: none;"
></iframe>

Possible Responses: #

1. User is logged in: The iframe is redirected to redirect_uri?code=AUTHORIZATION_CODE&state=xyz123. Your callback exchanges the code silently.
2. User is NOT logged in: Ternis Auth immediately returns an error without rendering a login form: redirect_uri?error=login_required&error_description=User+is+not+authenticated&state=xyz123
3. Consent Required: If new scopes require prompt: redirect_uri?error=consent_required&state=xyz123

4. Single Sign-Out (Global Logout) #

When a user logs out of one application or clicks "Log Out Everywhere" in their Account Center:

1. Local Token Revocation: The client application discards its local tokens.
2. Central Session Termination: The user is redirected to the central logout endpoint:

   GET /logout HTTP/1.1
   Host: auth.ternis.net
   

3. Session Purge: The central session cookie is invalidated, and active Passport tokens for that user session are revoked in the database.
4. Post-Logout Redirect: If a registered post_logout_redirect_uri is passed, the user is redirected back to the calling service.