A technical guide for implementing Cross App Access (XAA) with SAML-based enterprise applications, enabling AI agents to access APIs without migrating to OIDC. Covers the Identity Assertion Authorization Grant (ID-JAG) flow, how to decode and validate ID-JAG claims (especially the saml-nameid subject identifier), a five-step implementation checklist including user identity mapping via NameID + sp_name_qualifier, ID-JAG validation with issuer binding before signature verification, access token issuance (without refresh tokens), authorization server metadata updates, and Okta tenant configuration. Also includes a quick migration checklist for teams already using XAA with OIDC apps.
Table of contents
How XAA in SAML worksAnalyzing the ID-JAG claimsXAA implementation checklist for SAML-federated applicationsMaking cross-application requests from your SAML app securelyTakeaways for implementors who have both OIDC and SAML appsLearn more about Cross App Access, SAML, and OAuth 2.077 Impressions