I am planning to use a Canvas app for one of the AppExchange app. It will load the 3rd party page within Salesforce.
I am planning to use the Signed Request approach where the external website will implement Canvas SDK and it will authenticate the signed request.
Currently, the external site has authentication by using a username and password. As we are planning to use the signed approach, the external app will have one more way of authentication by signed request.
Question: As we are planning to use Canvas App within AppExchange with the Signed Request approach, is the signed request approach enough from a Security Review perspective or will it be mandatory to implement a single sign-on with the users of an external website? With a signed request, there will be additional validation like a valid SF user from a valid SF org is viewing the page or not.