多服务是否可共用单个OpenID Connect Relying Party？技术咨询

Great question—this is a super common sticking point when rolling out OpenID Connect across multiple independent services, especially with Google's strict OAuth 2.0/OpenID Connect implementation. Let's break this down clearly:

Core Background #

Google's IDP enforces strict rules around Relying Party (RP) configuration, specifically tied to domain validation and redirect URI security. The key thing to note: your services are on entirely separate top-level domains (company.com, service1.com, etc.), which changes the options available to you.

Option 1: Create Separate Relying Parties (Recommended) #

This is the approach Google recommends and aligns with best security practices for your setup:

• How to do it: For each service (company.com, service1.com, service2.com, service3.com), create a separate OAuth client ID in the Google Cloud Console. Configure each client with its own valid redirect URI (e.g., https://service1.com/auth/callback for service1, https://company.com/login/callback for your main site).
• Why this works:
  • Domain isolation: Google requires that all redirect URIs for a single client belong to a single verified domain (or its subdomains). Since your services are on separate TLDs, you can't share a single client across them anyway.
  • Security & permission granularity: Each client gets its own unique client ID/secret. If one service's credentials are compromised, the others stay safe. You can also tailor scopes per service (e.g., service1 only needs openid email, while service2 might require profile access).
  • Avoids configuration headaches: Mixing domains in a single client will lead to validation errors during authorization flows, which are tricky to debug.

Option 2: Shared Relying Party (Only Possible for Subdomains, Not Your Case) #

If your services were subdomains of a single TLD (e.g., service1.company.com, service2.company.com), you could verify the parent domain company.com and use a wildcard redirect URI (like https://*.company.com/auth/callback) with one shared client. But since your services are on independent TLDs, this isn't allowed by Google's security policies—they block cross-TLD redirect URIs in a single client to prevent spoofing.

Alternative: Centralized Auth Proxy #

If you want a unified login experience across all services, consider setting up a centralized auth service (e.g., auth.company.com) as your single RP. Here's how it works:

1. Users from any service are redirected to auth.company.com to authenticate with Google.
2. After successful login, the auth proxy issues its own internal token (like a JWT) to the user, then redirects them back to the original service.
3. Each service validates this internal token instead of directly interacting with Google's IDP.

This lets you use one RP for Google authentication while maintaining isolation between your services. It's a great middle ground if you want consistent branding and centralized auth management.

内容的提问来源于stack exchange，提问作者Sato