For me SSO is sign on where one need not type the password explicitly.

I see one of the possible way to achieve it is by using Certificates loaded in browser.

SAML/OAuth delegates the job of authentication to some IDP. As per my understanding these IDP in most cases use the certificates loaded in client browser to identify him/her.

I have following questions: 1) Why the web-sites doesn't use the client certificates directly. 2) If I have to pass the SAML token while calling the REST end point, how the header will look like eg. Basic aTA2MTk1111pB43he3juh3 for Basic or Bearer aTA2MTk1111pB43he3juh3 for OAuth

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.