Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain completely state-less and not have to build a shared session cache.
After reading more about SAML, OpenID, and JWT, it seems that encrypting the authentication and authorization payload in a JWT, which gets signed provides assurance that the data it contains is valid and untampered. That is the same level of protection that the tokens from SAML and OpenID use. After that, the same problems of token theft that apply to every session management system exist and there are well-known mitigations for that.