--- title: Cross-domain single sign-on with the Advanced Identity Cloud description: For organizations relying on AM's session and policy services with SSO, consider cross-Domain Single Sign-On (CDSSO) as an alternative to SSO through OpenID Connect. component: pinggateway version: 7.2 page_id: pinggateway:identity-cloud-guide:cdsso canonical_url: https://docs.pingidentity.com/pinggateway/2026/aic/cdsso.html llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2022-07-05T12:22:21Z superseded_by: https://docs.pingidentity.com/pinggateway/2026/aic/cdsso.html --- # Cross-domain single sign-on with the Advanced Identity Cloud For organizations relying on AM's session and policy services with SSO, consider cross-Domain Single Sign-On (CDSSO) as an alternative to SSO through OpenID Connect. This example sets up Advanced Identity Cloud as an SSO authentication server for requests processed by Identity Gateway. For more information about about Identity Gateway and CDSSO, see [Authenticate With CDSSO](../gateway-guide/sso.html#cdsso-auth). Before you start, prepare Advanced Identity Cloud, IG, and the sample application as described in [Example installation for this guide](preface.html#preface-examples). 1. Set up Advanced Identity Cloud: 1. Log in to Advanced Identity Cloud as an administrator. 2. Make sure that you are managing the `alpha` realm. If not, click the current realm at the top of the screen, and switch realm. 3. Go to [icon: group, set=material, size=inline] Identities > Manage > [icon: settings_system_daydream, set=material, size=inline] Alpha realm - Users, and add a user with the following values: * Username: `demo` * First name: `demo` * Last name: `user` * Email Address: `demo@example.com` * Password: `Ch4ng3!t` 4. Click [icon: verified_user, set=material, size=inline] Gateways & Agents, and add an IG agent with the following values: * ID: `ig_agent_cdsso` * Password: `password` * Redirect URLs: `https://ig.ext.com:8443/home/cdsso/redirect` 5. Select Services > Add a Service, and add a Validation Service with the following Valid goto URL Resources: * `https://ig.ext.com:8443/*` * `https://ig.ext.com:8443/*?*` 2. Set up Identity Gateway: 1. Set up IG for HTTPS, as described in [Configure IG for HTTPS (server-side) in standalone mode](../installation-guide/install-standalone.html#standalone-https). 2. Add the following `session` configuration to `admin.json`, to ensure that the browser passes the session cookie in the form-POST to the redirect endpoint (step 6 of [Information Flow During CDSSO](../gateway-guide/sso.html#figure-cdsso-auth)): ``` { "connectors": […​], "session": { "cookie": { "sameSite": "none", "secure": true } }, "heap": […​] } ``` This step is required for the following reasons: * When `sameSite` is `strict` or `lax`, the browser does not send the session cookie, which contains the nonce used in validation. If IG doesn't find the nonce, it assumes that the authentication failed. * When `secure` is `false`, the browser is likely to reject the session cookie. For more information, see [admin.json](../reference/AdminHttpApplication.html). 3. Set an environment variable for the IG agent password, and then restart IG: ```bash $ export AGENT_SECRET_ID='cGFzc3dvcmQ=' ``` The password is retrieved by a SystemAndEnvSecretStore, and must be base64-encoded. 4. Add the following route to IG, to serve .css and other static resources for the sample application: * Linux * Windows ``` $HOME/.openig/config/routes/static-resources.json ``` ``` %appdata%\OpenIG\config\routes\static-resources.json ``` ```json { "name" : "sampleapp-resources", "baseURI" : "http://app.example.com:8081", "condition": "${find(request.uri.path,'^/css')}", "handler": "ReverseProxyHandler" } ``` 5. Add the following route to Identity Gateway, replacing the value for the property `amInstanceUrl`: * Linux * Windows ``` $HOME/.openig/config/routes/cdsso-idc.json ``` ``` %appdata%\OpenIG\config\routes\cdsso-idc.json ``` ```json { "name": "cdsso-idc", "baseURI": "http://app.example.com:8081", "condition": "${find(request.uri.path, '^/home/cdsso')}", "properties": { "amInstanceUrl": "https://myTenant.forgeblocks.com/am" }, "heap": [ { "name": "SystemAndEnvSecretStore-1", "type": "SystemAndEnvSecretStore" }, { "name": "AmService-1", "type": "AmService", "config": { "url": "&{amInstanceUrl}", "realm": "/alpha", "version": "7.2", "agent": { "username": "ig_agent_cdsso", "passwordSecretId": "agent.secret.id" }, "secretsProvider": "SystemAndEnvSecretStore-1", "sessionCache": { "enabled": false } } } ], "handler": { "type": "Chain", "config": { "filters": [ { "name": "CrossDomainSingleSignOnFilter-1", "type": "CrossDomainSingleSignOnFilter", "config": { "redirectEndpoint": "/home/cdsso/redirect", "authCookie": { "path": "/home", "name": "ig-token-cookie" }, "amService": "AmService-1", "verificationSecretId": "verify", "secretsProvider": { "type": "JwkSetSecretStore", "config": { "jwkUrl": "&{amInstanceUrl}/oauth2/realms/alpha/connect/jwk_uri" } } } } ], "handler": "ReverseProxyHandler" } } } ``` Notice the following features of the route compared to `cdsso.json` in [CDSSO for IG in standalone mode](../gateway-guide/sso.html#cdsso-sa), where Access Management is running locally: * The AmService `URL` points to Access Management in the Advanced Identity Cloud. * The AmService `realm` points to the realm where you configure your IG agent. 3. Test the setup: 1. Go to . If you see warnings that the site is not secure, respond to the warnings to access the site. The Advanced Identity Cloud login page is displayed. 2. Log in to Advanced Identity Cloud as user `demo`, password `Ch4ng3!t`. Access Management calls `/home/cdsso/redirect`, and includes the CDSSO token. The CrossDomainSingleSignOnFilter passes the request to sample app.