title: Pass SAML response from a Web App to the REST API for authentication?
body: <p>We have a <strong>Web App</strong> using <strong>REST API</strong>. The REST API is based on Loopback and uses it's built-in token-based authentication. For the Web App we use forms based authentication over HTTPS, so the user has to enter his username and password which we then use to get access token from the REST API via <code>POST /users/login</code> endpoint.</p>
  
  <p>One of our customers asked us to support <strong>single sign-on (SSO)</strong> authentication through <strong>SAML 2.0</strong> and <strong>AD FS</strong>.</p>
  
  <p>We configured our Web App as a service provider (Relying Party in AD FS) and managed to support SSO for it. The changeling part is the authentication between Web App and the REST API. The idea right now is to configure both Web App and the REST API as the same Relying Party and add new <code>POST /users/saml-login</code> endpoint to the REST API, so the Web App can send a SAML response to that end point and get an access token based on the claims specified in the SAML response. Everything else should work as it used to work before. Here is the flow I imagine: </p>
  
  <ol>
  <li>Web App generates SAML request and redirects a user to the IdP login page</li>
  <li>After a successful login the user is redirected back to the Web App with the SAML Response</li>
  <li>Web App acts as a proxy and redirects the SAML Response to the REST API endpoint (<code>POST /users/saml-login</code>) where it is validated</li>
  <li>If the SAML response is valid the API returns an access token based on the claims</li>
  <li>Web App uses access token for further communication with the REST API same as before</li>
  </ol>
  
  <p><strong>Here is the question:</strong> Is it OK to implement SAML-based SSO this way? Do you see any issues or security considerations with this approach? Are there any alternatives?</p>
  
  <p>I have read a lot of articles on the web and questions here on StackOverflow about how to use SAML &amp; REST API together:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/38582809/propagate-saml-assertion-response-security-context-to-downstream-services-apps">Propagate SAML Assertion Response/Security Context to downstream Services/Apps</a></li>
  <li><a href="https://stackoverflow.com/questions/19446131/rest-api-authentication-with-saml">REST API authentication with SAML</a></li>
  <li><a href="https://stackoverflow.com/questions/19882181/saml-and-back-end-rest-service-authentication">SAML and back-end REST service authentication</a></li>
  <li><a href="https://blog.netspi.com/attacking-sso-common-saml-vulnerabilities-ways-find/" rel="noreferrer">Attacking SSO: Common SAML Vulnerabilities and Ways to Find Them</a></li>
  </ul>
  
  <p>None of them really helped me to confirm or reject the idea described above.</p>