title: How should I use SAML login with a REST API + SPA app?
body: <p>I want to use SAML login for a single web application with a REST API. How should I do this? Usually, say with OAuth, lets use Google/Firebase as an example: </p>
  
  <ul>
  <li>SPA calls Google to login. Google returns a Google ID token</li>
  <li>SPA can call Server with Google ID token which server can verify with Google and return an access token for use with the application</li>
  </ul>
  
  <p>Firstly is this correct or did I get something wrong so far? </p>
  
  <hr>
  
  <p>But with SAML, from what I can see, its user is redirected to SAML IDP, SAML IDP then redirects user to a server assertion URL. Because there is this redirect, how do I use it in the context of REST? I am unfamiliar with SAML, but I dont see a token. The server just gets an "assertion" with the user information? </p>