so my project is that I'd like to pull data from a bunch of different services/API's and show them in a single dashboard. SSO is a requirement so I want to make sure the user doesn't have to put in their password over and over.
The system already has SAML2.0 set up with ADFS which is configured as the identity provider for all the services.
The issue is that when a user uses SAML to log into a service, they leave my dashboard app and don't get any of the user permissions for that service. For example, say the user is trying to access Gitlab and they only have access to a certain number of projects, unless they go into gitlab and generate a user API key and copy/paste it into my dashboard app, I can't get that user's permissions when making API calls.
From my research, it sounds like using OAuth2.0 is the solution to this; set up ADFS to generate tokens for a user (as the Authorization server) and then integrate it with applications that use OAuth2.0 (which would be the resource servers) and my dashboard app would be basically a client hanging on to the tokens. This would enable me to make API calls with scoped permissions.
Does this sound like a good idea? Instinctually, I feel that this has got to be a common problem that's been solved many times before but I am not formulating the Google/Stackoverflow searches for the solution.
