I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for them.
I've been doing some reading and research into different Authentication and Authorization flows (SAML and OpenID Connect to be specific).
Assuming I am building a web based application that uses some other provider to do the authentication (Okta, Ping Federate, etc), both SSO using SAML and OIDC seem to have flows that involve redirecting to the IdP to provide the actual Authentication for the user.
Afterwards, SAML seems to use further browser redirects to perform the Authorization for my own server, whereas OIDC can use REST API calls using the exchange token or access token or whatever without needing browser redirects anymore.
My question is: why must the browser be used with the IdP when doing the actual Authentication. I understand that the only way to ensure the user's credentials are not stolen along the way is that the IdP has absolute control over it and never exposes it to any other apps involved. But are there any generally acceptable and modern standards that involve, say, just REST API calls or some way that doesn't involve browser redirects? For example, I write my own page to capture the username/password, that I then POST to an IdP.
Or is the general consensus that the Browser must redirect at least once to the IdP in order to verify that you are even authenticated, and then if the requesting page is allowed to use the user currently authenticated in the IdP.
TL;DR: Is there any Auth standards that doesn't require a browser redirect to the IdP, or do all generally accepted Auth standards require it?
