I am building a system that have API and SPA. The server have user manage function that can control the permission. Now I want to allow user to login by SSO provider (or simply, allow user using the their Google/Microsoft account to login their account that registered in system).

Question is: What auth flow is best for this case if I want to issued access token by myself?

I want do that:

1. read the user identifier from SSO provider.
2. find the user that bind to this identifier
3. issue access token that sign by myself

In authorization code flow, SPA will get the id token and access token and call the API with that token. That mean the API will need to ask the SSO provider to validate the token is valid every time. I want to issue the token that sign by myself and check the token on the server locally. Then I can use the user identifier to check the permission from persistence store every time.

If I want to issue self-signed token, what flow is best?

1. Create the API endpoint that accept the token from SSO and return the self-signed token
2. Create the API endpoint that accept the authorization code. Let the server use the authorization code to get the id token from SSO provider.
3. otherwise?

Also, which token is I will need to read? id token or access token?