Single Sign-On Support for REST APIs

Question

I am trying to find the best way to solve the following problem: our application is SaaS and supports SAML for login. The application also provides REST APIs, which are supposed to be used in automated and automated processes, that is, there is no interactive user to enter credentials. We must allow developers to programmatically authenticate the raw process against the corresponding IdP (which is already defined, because the same credentials that are used to access the API can also be used to access the web application).

The flow, which I assume, is as follows: the program authenticates using a special API, receives a token and uses the token for the next calls.

Most of the answers that I find when looking for the best ways to protect the REST APIs offer oAuth, which usually requires an interactive user, because they discuss the possibility of connecting to the REST API user interface on another system on behalf of the user who enter the password there. Is also the answer to my call? If so, what is the flow?

Thanks!

Answer 1

Indeed, OAuth 2.0 can be used for this use case, since it allows the so-called clients (i.e. your automatic processes) to receive the access token provided by the developers and use this token for your APIs.

A typical thread to use here is a code stream: you must run an authorization server that issues tokens to clients if they agree with the developers. Developers had to connect to the authorization server using SAML Web SSO.

Note that it does not require an active user while accessing the REST API, but it will require one at the time the token is issued. I believe that this is what you are really looking for. If not, there are other threads that may be involved that generally do not require an active user, but I believe that they are not suitable for this particular use case; because you want customers to work on behalf of the developers.

The authorization server can also issue an update token to the client in addition to the access token, so that after the expiration of the old access token, your client can receive a new access token from the authorization server using the update token, without having to enable the developer again (in interactive mode).