Bypass Azure AD SAML

Question

I got SAML setup on my AD and I have the private and certificate PEMs along with the certificate and metadata and I want to know if it's possible to bypass the login from API? I'm developing a Node.JS API which I want to make requests to the server behind the SAML login but I need to bypass it with what I got.

Maybe a way to generate a token from Azure's API (to use as bearer authorization) would work like how you do it with OAuth?

I'm not asking for any other solution (like whitelisting etc.), I just need it to be token / API based

Answer 1

To bypass azure ad, you may chise for the On behalf flow.

• For single-page apps (SPAs), here we pass an access token to a middle-tier confidential client to perform OBO flows instead.

This will only work, if the respective permissions (scope grants) are already granted when you try to get an access token using the on-behalf of flow.

Here API A authenticates to the Microsoft identity platform token issuance endpoint and requests a token to access API B.

https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token
with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
client_id=xxx
&client_secret=saxx1s
&scope=https://graph.microsoft.com/user.read+offline_access
&requested_token_use=on_behalf_of

Here we need to expose api and here I am giving user.read

And exposed api

The response has access token, refresh token

{
  "token_type": "Bearer",
  "scope": "https://graph.microsoft.com/user.read",
  "expires_in": 3269,
  "ext_expires_in": 0,
  "access_token": "xx",
  "refresh_token": "xxxx"
}

Please check Microsoft identity platform and OAuth2.0 On-Behalf-Of flow - Microsoft Entra | Microsoft Learn

Reference : how-to-use-azure-ad-access-token-to-bypass-microsoft-online-login