Enabling Cross App Access for SAML-Based Resource Apps

Summary

Cross App Access (XAA) lets applications using existing SAML federation obtain API access without migrating to OpenID Connect (OIDC). An agent presents a short-lived Identity Assertion Authorization Grant (ID-JAG), which the resource authorization server validates, resolves to a user, and exchanges for its own access token; SAML processing remains upstream. For SAML identity resolution, implementations must validate the saml-nameid sub_id and match issuer, NameID, and sp_name_qualifier rather than relying on NameID alone. The guide recommends binding iss to a registered SAML connection before verifying the JWT against that connection’s JWKS, then checking typ, aud, and client_id and applying local scope policy. It also walks through Okta configuration and xaa.dev checks that redeem the ID-JAG, call the API, and export conformance results.

Takeaways

1. 1

   SAML user resolution uses sub_id in saml-nameid format and must match the SAML issuer, NameID, and sp_name_qualifier; NameID alone may not uniquely identify a user.

2. 2

   The resource authorization server should bind iss to a registered SAML connection before verifying the ID-JAG signature against that connection’s JWKS, then validate typ, aud, and client_id.

3. 3

   After resolving the user, the server issues an access token according to local policy; the guide explicitly says not to issue a refresh token.