For me SSO is sign on where one need not type the password explicitly.
I see one of the possible way to achieve it is by using Certificates loaded in browser.
SAML/OAuth delegates the job of authentication to some IDP. As per my understanding these IDP in most cases use the certificates loaded in client browser to identify him/her.
I have following questions:
1) Why the web-sites doesn't use the client certificates directly.
2) If I have to pass the SAML token while calling the REST end point, how the header will look like eg.
Basic aTA2MTk1111pB43he3juh3 for Basic or
Bearer aTA2MTk1111pB43he3juh3 for OAuth