Okta Brings Cross App Access to SAML Enterprise Apps
Quick Reads
- Okta details Cross App Access (XAA) for SAML-based enterprise apps
- Agents use a short-lived JWT called an ID-JAG to request API access
- No migration to OIDC required, existing SAML federation stays intact
- XAA is an early access feature; Integrator Free Plan accounts are supported
AI agents now need secure, scoped access to enterprise APIs. Okta has published a technical guide showing how developers can enable Cross App Access (XAA) for SAML-based enterprise apps, without migrating to OpenID Connect (OIDC).
This matters for Nigerian and African SaaS companies building multi-tenant enterprise products. Many still rely on SAML for customer federation. Until now, supporting AI agent access often meant forcing protocol migrations that disrupted production environments. Okta’s XAA approach removes that requirement.
The solution centres on the Identity Assertion Authorization Grant (ID-JAG) specification. When an agent needs API access, it presents an ID-JAG, a short-lived JSON Web Token issued by the customer’s Identity Provider. Your resource server then validates the token, resolves the user, and issues its own access token. Importantly, the existing SAML SSO flow stays completely unchanged.
However, SAML introduces a unique challenge: there is no direct sub claim equivalent. Consequently, developers must resolve user identity from the sub_id field, specifically using the saml-nameid format. Resolving on NameID alone is insufficient. Two different organisations could each have a user named “Alex Chen.” Therefore, developers must match on NameID plus sp_name_qualifier together to guarantee uniqueness across tenants.
The validation sequence is equally critical. Okta’s guide warns against verifying the JWT signature before checking the issuer binding. An attacker could otherwise create their own IdP, sign a token, and spoof your customer’s SAML issuer. The correct order is: resolve the connection from the iss claim first, then verify the signature against that connection’s JWKS keys.
Furthermore, developers should not issue a refresh token alongside the access token. The ID-JAG itself replaces refresh token functionality. When the access token expires, the client resubmits the same ID-JAG. Additionally, the ID-JAG’s jti claim prevents replay attacks within the validity window.
Once five implementation steps are complete, mapping the NameID, validating the ID-JAG, issuing the access token, updating authorization server metadata, and configuring the Okta org, agents can authorize requests against the API. Moreover, the resource server’s discovery document must declare urn:ietf:params:oauth:grant-profile:id-jag support so clients can locate XAA capabilities automatically.
Cross App Access is currently an early access feature in Okta. Integrator Free Plan accounts already include XAA support. Developers building on both OIDC and SAML apps need only adjust the subject resolution logic; token issuance rules and redemption checks remain the same across both protocols.
