00u7rzn64fLQfr9pi0x71.540317544878881E12 (Customer) asked a question.
Securing API with SAML
So we have, what I imagine is a very common architecture. We have a static SPA, hosted on s3/cloudfront, that talks to an api. The SPA is secured via OIDC, and it sends the JWT to the API on every request. The API verified the token, figures out who the user is, etc.
Now we're being required to use SAML via okta. What changes will we have to make to our architecture? I imagine we can no longer use an SPA hosted on a SPA, but would need our own server that "speaks" SAML. How do get the authenticate the API? Is there a similar concept of sending some over in a header to be verified?
Can anyone with similar experience securing API with SAML help Avi out here?
Hi Avi,
Related to your inquiry , we will need more information on how your system is set up , in order to investigate what would be the best way of approaching this.
I would highly recommend opening a support ticket as a delicate configuration such as yours may need certain settings implemented to accommodate the desired flow .
Thank you
Andrei Kosa
Okta Support.