I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here.
I am trying to create an API that will be accessed by a 3rd party. This 3rd party authenticates their users using some unknown system (they use something like auth0 or Okta). Their web application will be making requests to our API on behalf of the users. We need to validate the these requests are coming from authenticated users from the specific 3rd party, but we don't want to keep track of the 3rd party's users. We need these requests to have tokens containing claims pertaining to the individual user, but it would be up to the 3rd party to handle these claims.
Is what I'm describing here possible? I've been reading up on Federated SSO, but it doesn't quite seem to solve the problem that we're having.