We have two microservices (Service1 and Service2) which are developed using Spring Boot and we have React application which makes call to Service1 to get the data that has to be populated on UI.

• React application is taking care of authentication. Once user is authenticated, it is making call to Service1 by passing access_token in Authorization header as Service1 is secured.
• Service2 is secure and we have to pass access_token in Authorization header to get data.
• Currently Service1 is making a REST API call to Service2 to get the data. As of now we are getting access_token using client_credentials flow and setting it in Authorization header when making call to Service2.

Now issue is the API’s in Service2 are user specific. So we cannot make use of client_credentials flow. We are trying to do SAML2 SSO between Service1 and Service2 to get user specific access_token.

Could you please let me know the steps to configure the same in Okta and Spring boot application.

I tried to setup SAML2 Application for Service1 in okta. When I accessed the App embedded link, it asked for Login and post successful login it is sending SAMLReponse to Service1 Sign-On Url.

From the SAMLResponse, I have extracted the Assertion and tried to exchange the SAML Assertion token for Access token by using SAML Bearer Assertion Flow. When I tried to exchange the token, I am getting “‘assertion’ is not a valid SAML 2.0 Assertion”