I have an internal app that allows users to sign in using Azure AD. On authentication, a SAML assertion is returned. However, some of the calls that the application makes require a JWT. WHat is the best way for me to get a JWT when a user signs in? Or is there a way for me to exchange the SAML for a JWT?
1 Answers
Disclaimer: I'm not expert an any of this stuff; I'm still learning it too and struggling with a similar problem. That said, here is my understanding.
I'm pretty sure there is no connection between SAML and JWT. Not a surprise, given that SAML 2.0 dates back to 2005 and JWT got started around 2012. So it's logically impossible for the SAML spec to say anything about JWTs.
If my understanding is correct, you have two options:
Do not use SAML directly. Instead of interacting with a SAML IdP (identity provider), use OpenID Connect and OAuth 2.0 with a provider that acts as an authentication broker. Configure the broker to act as service provider to your chosen SAML IdP. Configure your application to act as relying party (OAuth terminology, I think?) on the authentication broker. Then your app is OAuth 2.0/OpenID Connect/JWT all the way down. Your only interaction with SAML is configuring an authentication broker. Main downside is now you have to select and pay for an authentication broker as well as a SAML IdP.
Write your own authentication/authorization service to consume SAML assertions and issue JWTs. This might be necessary anyways, depending on how you need to represent authorization info in your JWTs.
Related