{"action":"opened","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2242","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2242/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2242/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2242/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2242","id":119793116,"number":2242,"title":"Recommended approach for federation and shared resources?","user":{"login":"bblunden","id":12699527,"avatar_url":"https://avatars.githubusercontent.com/u/12699527?v=3","gravatar_id":"","url":"https://api.github.com/users/bblunden","html_url":"https://github.com/bblunden","followers_url":"https://api.github.com/users/bblunden/followers","following_url":"https://api.github.com/users/bblunden/following{/other_user}","gists_url":"https://api.github.com/users/bblunden/gists{/gist_id}","starred_url":"https://api.github.com/users/bblunden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bblunden/subscriptions","organizations_url":"https://api.github.com/users/bblunden/orgs","repos_url":"https://api.github.com/users/bblunden/repos","events_url":"https://api.github.com/users/bblunden/events{/privacy}","received_events_url":"https://api.github.com/users/bblunden/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-01T19:48:37Z","updated_at":"2015-12-01T19:48:37Z","closed_at":null,"body":"Hi\r\n\r\nIn a nutshell, we would like to sign on to one IDS3 and gain token based access to resources protected by another IDS3.\r\n\r\nWe have IDS3 v1.6 (IDP1) providing Hybrid Flow access to multiple MVC katana UIs (clients).  These UIs provide Authorize Bearer Tokens to gain access to various protected apis (scopes).  Lets call this Installation 1. We also have installation 2 with identical UIs and apis all being protected by another IDS3 v1.6 (IDP2).  ClientID and Scope names are identical in each installation however the underlying data stores are unique.  Everything is working well for each of installation.\r\n\r\nNow, we would like a user to sign-on to one SSO (say installation 1) and have it's clients be able to access resources from the other installation, as well as its own.  The data sources beneath the apis are different and we want to provide a \"merged\" data effect.  So, we would like a UI to be able to access the same scopes on each installation.\r\n\r\nI've been reviewing AuthenticationOptions.IdentityProviders and AuthenticateExternalAsync. I believe I need to create a ConfigureAdditionalIdentityProviders method using OpenIdConnectAuthenticationOptions and extension method UseOpenIdConnectAuthentication in similar fashion to the google, facebook and twitter samples.  Are arc_values relevant for our scenario?\r\n\r\nI'm unclear on how to authenticate with the opposing IDP too so I thought it would be good to get some feedback before setting off, perhaps in the wrong direction.  If anyone can provide insight on the following, I would appreciate it.\r\n\r\n1. What is the best way to get access tokens from the \"other\" installation?\r\n2. Is it possible to use a single access token across installations?  how?\r\n\r\nBest Regards,\r\nBrent\r\n"}}