I have an Apex class that is consuming a partners REST webservices. Currently all users of my app (in the installed org) access the service via a single API Integration user.
We now want make the REST reponse dependant on the Users permissions, so the external REST service needs to know a Users role.
Passing the role as part of the request is not safe so we though about SAML and Signle Sign on Auth Flows as described here: https://developer.salesforce.com/docs/atlas.en-us.sso.meta/sso/sso_about.htm
The external service could know about each consuming user from the salesforce side. I don't know how, but maybe Salesforce could transparently log the Salesforce user in when creating a webservice call.