Why doesn't OIDC SSO work between apps on different domains with custom UI?

I'm building SSO using OpenID Connect between two apps:

• App1 (front end and backend done in php) hosted at (eg.app1.stk.in)
• App2(front end in angular and backed python) hosted at (eg.app2.cloud.net)
• Both apps use same IdP(Aws COGINITO).and are configured under the same user pool but client id are different.

Goal: if a user logs into App1 ,and then navigate to App2 ,they should be logged in automatically(SSO)-no login prompt. We now use prompt=none url for silent login to achieve this. But when use this method it redirected to hosted UI of AWS Coginito for login .We need our own custom UI for login we valid session is not exist.

What's Failing:

• With custom UIs,SSO doesnot work.App2 doesn't recoginize that the user already logged into App1.
• Session cookies are set in App1's domain (app1.stk.in) and not accessible from App2's domain(app2.cloud.net).

My Questions:-

1. Is it true that SSO with prompt=none only works if using the identity provider's hostedUI, if applications are in different domain, because only it can set across client/shared cookies?
2. Are there any secure work arounds for sharing session state across domains using OIDC?

Continue reading...