---
title: Single Sign-On (SSO) Architecture
category: Core Protocols & SSO
order: 5
badge: Enterprise
description: Ecosystem-wide Single Sign-On mechanics, cross-domain handshakes, silent authentication, and session termination.
---

# Single Sign-On (SSO) Architecture

Ternis Auth powers a seamless **Single Sign-On (SSO)** experience across all applications, internal services, and partner sites in the Ternis network. Once a user authenticates on one Ternis property, they are recognized and automatically signed in across other interconnected applications without re-entering credentials.

---

## 1. How Ecosystem SSO Works

The Ternis SSO architecture combines centralized session tracking with standard OpenID Connect authorization code flows:

```
[ Browser ]              [ Application A ]            [ Ternis Auth Central ]        [ Application B ]
     │                           │                             │                            │
     │ ── 1. Login to App A ───> │                             │                            │
     │ <─ 2. Redirect to Auth ── │                             │                            │
     │ ── 3. Authenticate with Password & 2FA ───────────────> │ (Session Created)          │
     │ <─ 4. Auth Code + Redirect to App A ─────────────────── │                            │
     │ ── 5. Logged into App A   │                             │                            │
     │                           │                             │                            │
     │ ── 6. Later: Navigate to App B (e.g. auth.thosted.de) ─────────────────────────────> │
     │ <─ 7. App B Redirects to /oauth/authorize ────────────────────────────────────────── │
     │ ── 8. Browser sends central session cookie ───────────> │ (Session Validated)        │
     │ <─ 9. Immediate Auth Code Redirect (No Password Prompt) │                            │
     │ ── 10. Logged into App B Automatically! ───────────────────────────────────────────> │
```

### Key Advantages
1. **Frictionless Navigation**: Users switch between tools (e.g. Ternis Git, Hosting Console on `thosted.de`, Developer Hub on `ternis.dev`) without interruption.
2. **Centralized Credential Security**: Passwords and 2FA credentials are never shared with or handled by individual client applications.
3. **Instant Enterprise Revocation**: Revoking a session in the Account Portal terminates access ecosystem-wide.

---

## 2. Hosted Cloud Services (`auth.thosted.de`)

Ternis operates cloud hosting and managed SaaS under the `thosted.de` network.

`auth.thosted.de` functions as a trusted SSO gateway within the federation:
- Pre-authorized callback domains: All subdomains under `*.thosted.de` are whitelisted in the platform's redirect rules.
- Scopes pre-configured: Applications requesting `openid profile email ternis:sso` receive instant, zero-prompt authorization if the user already holds an active central session.
- Developers hosting apps on `thosted.de` configure their redirect URIs to `https://app.thosted.de/sso/callback` or `https://auth.thosted.de/callback`.

---

## 3. Silent Authentication (`prompt=none`)

Single Page Applications (SPAs) and dynamic frontend dashboards can silently check whether the user is logged in to Ternis Auth without redirecting the user away from their current page.

### The `prompt=none` Request

Send an authorization request with `prompt=none` inside a hidden `<iframe>`:

```html
<iframe 
  id="sso-silent-frame"
  src="https://auth.ternis.net/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fsilent-callback&scope=openid%20profile%20ternis%3Asso&prompt=none&state=xyz123"
  style="display: none;"
></iframe>
```

### Possible Responses:
1. **User is logged in**: The iframe is redirected to `redirect_uri?code=AUTHORIZATION_CODE&state=xyz123`. Your callback exchanges the code silently.
2. **User is NOT logged in**: Ternis Auth immediately returns an error without rendering a login form:
   `redirect_uri?error=login_required&error_description=User+is+not+authenticated&state=xyz123`
3. **Consent Required**: If new scopes require prompt:
   `redirect_uri?error=consent_required&state=xyz123`

---

## 4. Single Sign-Out (Global Logout)

When a user logs out of one application or clicks "Log Out Everywhere" in their Account Center:

1. **Local Token Revocation**: The client application discards its local tokens.
2. **Central Session Termination**: The user is redirected to the central logout endpoint:
   ```http
   GET /logout HTTP/1.1
   Host: auth.ternis.net
   ```
3. **Session Purge**: The central session cookie is invalidated, and active Passport tokens for that user session are revoked in the database.
4. **Post-Logout Redirect**: If a registered `post_logout_redirect_uri` is passed, the user is redirected back to the calling service.