Enable Your SAML Requesting App for Cross App Access

Summary

Cross App Access allows enterprise applications federated with Security Assertion Markup Language to interact with third-party resource APIs without migrating to OpenID Connect. The flow adapts the Identity Assertion Authorization Grant specification to SAML by adding three token exchange steps following the standard single sign-on handshake. First, the application exchanges the validated SAML assertion for an OAuth refresh token using Okta's token endpoint and a private key JSON Web Token. The application then uses the refresh token to request a short-lived Identity Assertion Authorization Grant token from Okta. Finally, the application presents the Identity Assertion Authorization Grant token to the third-party authorization server to obtain an OAuth access token.

Context

Enterprise applications federating users via SAML need to grant agents or services access to third-party APIs without executing a full migration to OpenID Connect.

Approach / What changed

Implement Cross App Access by chaining token exchanges: exchange the initial SAML assertion for an OAuth refresh token via RFC 8693, exchange that refresh token for a short-lived ID-JAG token, and redeem the ID-JAG token at the resource authorization server for an API access token via RFC 7523.

Takeaways

• The SAML assertion extracted during the ACS request must be Base64-encoded and exchanged immediately for a refresh token, and must never be persisted past this initial exchange.
• Both the refresh token exchange and the ID-JAG token exchange require a sensitive client assertion formatted as a private key JWT signed with an asymmetric key pair.
• If the ID-JAG token expires, a new one is requested using the refresh token, but if the refresh token expires with an invalid_grant error, the user must re-authenticate via SAML SSO.

Related reading

• Okta · Aug 21, 2026

  Add Cross App Access to Your OIDC Requesting Application

  OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.

  Sohail Pathan

• Auth0 · Aug 20, 2026

  Enterprise-Managed Authorization for your MCP server: Setting Up and Testing XAA in Auth0