How to implement SSO between two web applications, one embedded into the other (iframe)?

I have a web application protected by Keycloak with Resource Owner Password Credentials Grant. Both the frontend and the backend APIs are protected. I need to embed the frontend into a third party application, protected by its own Identity Provider. The user should log into the third party application and automatically get access to mine, which should be rendered into an iframe, without having to log in again. What is the recommended or most convenient approach to implement the authentication flow between the two systems? Should the access token issued by the third party IdP be exchanged with a Keycloak-issued token?

Apr 16, 2025 - 10:32

I have a web application protected by Keycloak with Resource Owner Password Credentials Grant. Both the frontend and the backend APIs are protected. I need to embed the frontend into a third party application, protected by its own Identity Provider. The user should log into the third party application and automatically get access to mine, which should be rendered into an iframe, without having to log in again. What is the recommended or most convenient approach to implement the authentication flow between the two systems? Should the access token issued by the third party IdP be exchanged with a Keycloak-issued token?