We have a SaaS running on AWS that we want to integrate with Salesforce. In a first step we want to add a web tab to the Salesforce UI and have a single-sign-on with our application so that if somebody logs into Salesforce and they go to the web tab with our application they are automatically logged in there as well.
I have read about SSO for Composite Apps (https://developer.salesforce.com/page/Single_Sign_On_for_Composite_Apps), but that uses session_id as a parameter and a SOAP call to authenticate the user, which doesn't sound like current best practices. I would have expected to use the standard SAML or OAuth to authenticate the user.
Questions is: is passing the session_id and server_url to my composite app the current best practice to achieve SSO with a composite app, or can I do this using SAML or OAuth?