Enable Your SAML Requesting App for Cross App Access

Summary

Cross App Access allows enterprise applications federated with Security Assertion Markup Language to interact with third-party resource APIs without migrating to OpenID Connect. The flow adapts the Identity Assertion Authorization Grant specification to SAML by adding three token exchange steps following the standard single sign-on handshake. First, the application exchanges the validated SAML assertion for an OAuth refresh token using Okta's token endpoint and a private key JSON Web Token. The application then uses the refresh token to request a short-lived Identity Assertion Authorization Grant token from Okta. Finally, the application presents the Identity Assertion Authorization Grant token to the third-party authorization server to obtain an OAuth access token.

Takeaways

1. 1

   The SAML assertion extracted during the ACS request must be Base64-encoded and exchanged immediately for a refresh token, and must never be persisted past this initial exchange.

2. 2

   Both the refresh token exchange and the ID-JAG token exchange require a sensitive client assertion formatted as a private key JWT signed with an asymmetric key pair.

3. 3

   If the ID-JAG token expires, a new one is requested using the refresh token, but if the refresh token expires with an invalid_grant error, the user must re-authenticate via SAML SSO.