My team is tasked with implementing SSO into our web application (full .net 4.8 hosted in Azure). However, we need to rely on authentication of an external application.

A bit of context. Imagine there are 2 separate companies (A and B) which have separate web apps (SP_A and SP_B). We are the company B in this context.

Here is the requested workflow:

1. A user of SP_A logs in SP_A. Authentication process is unknown to us.
2. This user wants to log in to SP_B without typing password and email (stored to authenticate them in SP_B).
3. They click on a button somewhere in SP_A and "magically" it signs them into our SP_B without any prompts.

We have accomplished that with JWT tokens nested in Authorization headers. Here is what happens behind the scenes:

1. A user presses the button in SP_A which makes a call to our REST API. Request has 2 parameters: a. API Key (we provide it to company A), b. Company Name
2. The API confirms that API key is assigned to a said company (A) and issues a JWT
3. JWT token is returned to the client and is included in the auth headers with all subsequent requests
4. The next request to our API contains user email and org name. API verifies that such user exists in our DB as well, authenticates and signs them into out SP_B web app.

Our client requested that we use SAML2.0 protocol instead.

I am using ITfoxtec sample projects as a starting point, but I am quite lost. All external articles want to enable one centralized IdP which would prompt a user for password and email once and Claims will be passed from IdP to SPs. It does not apply to our case, since users are auth-ed in SP_A app.

Thoughts?