Adding new service to authenticated website

Question

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code into the existing codebase is to find a way to authenticate to the new site and leverage the APIs that are already there.

My first thought was to create an API token authentication for the new APIs and rely on that for communicating from our client to this new backend but I don't think this will be enough. The data is sensitive and the thought of having API keys that can be easily taken from our client app I don't think is a good fit for this project.

My second thought was along the same lines as API tokens but have them created only when the user logs in to the existing site. The existing site would create, store, and send some piece of identifying information after the SAML authentication that the new back end can use to identify the client as being legitimate when it sends this with the request. This makes sure the user has to login to our site first and there's no private/public keys here to take... I think.

Third is just mirror the new API in the existing app and just make the new APIs not reachable from the web then just proxy calls from our existing app to the new app.

Any thoughts and criticisms of these ideas is welcome or what other people have done to solve this kind of problem where they have a running web app with authentication and need to add new services that come along.

• user22815: It sounds like you are trying to implement something like OpenID, is this assertion correct?
• ThrowsException: To some degree yes. The TL;DR version is I have a site A where users authenticate against CAS. Now I have a new site B that's just a bunch of RESTful endpoints but I want it so that from website A I can call the RESTful endpoints in B and have them authorized/authenticated. It's possible that I could get official OpenID support turned on in our CAS server but I don't know what the turnaround time is for that and we were looking to start using these new endpoints immediatly
• user22815: Do you control both sites? If so, you might just be able to use SSL to establish trust between the servers, after using a traditional login to establish trust between the client and the first server.
• ThrowsException: Yes I'm in the best position here where I control all the websites. So the SSL trust does that mean I would be making the calls from the backend of site A to site B? So far the more I think about it this is the best way to go.
• tom: you could set up site b as a SAML service provider, use the same entity ID/certs and replay the original saml assertion to it.