I have Spring boot authorization server(Auth Server) and resource server that generates OAUTH2 access_token. It uses a IDP for authentication through SAML.

Also I have react web application gets access token from Auth server when a browser has valid session and makes API call to resource server. This is perfectly working.

I have another web application gets authenticated directly from IDP by any means. Here there is a valid session in the browser. Now the web application loads a javascript that gets data from my resource server.

If I use iFrame instead of javascript to get data from resource server then iFrame gets access token from Auth server that in turn connects to IDP to get authenticated. This is also working considering I have proper Content Security Policy.

But I wanted to remove iframe dependency here, Can javascript gets access_token from auth server which gets authenticated with IDP through SAML ?