How should I use SAML login with a REST API + SPA app?

Question

I want to use SAML login for a single web application with a REST API. How should I do this? Usually, say with OAuth, lets use Google/Firebase as an example:

• SPA calls Google to login. Google returns a Google ID token
• SPA can call Server with Google ID token which server can verify with Google and return an access token for use with the application

Firstly is this correct or did I get something wrong so far?

---

But with SAML, from what I can see, its user is redirected to SAML IDP, SAML IDP then redirects user to a server assertion URL. Because there is this redirect, how do I use it in the context of REST? I am unfamiliar with SAML, but I dont see a token. The server just gets an "assertion" with the user information?

Answer 1

Here is the sequence of events which happen when the application is using SAML for the authentication:

1. server should send a response to the client with the URL to SAML IDP.
2. client application redirects the browser to SAML IDP (1).
3. After successful authentication, SAML server sends response with the redirect back to the client. The browser automatically posts the HTML form SAML server to your server.
4. After validating SAML assert and successful authorization (you can use user's information or other attributes to authorize the user to use your application), your server should generate a token that now can be used by the client application.

This is a basic scenario.

See spirng-saml project here, you can try and play with the sample web application. https://projects.spring.io/spring-security-saml