diff --git a/pkg/services/authn/authnimpl/service.go b/pkg/services/authn/authnimpl/service.go
index e7182dcab52..644adebc386 100644
--- a/pkg/services/authn/authnimpl/service.go
+++ b/pkg/services/authn/authnimpl/service.go
@@ -491,7 +491,7 @@ func orgIDFromHeader(req *http.Request) int64 {
 }
 
 func (s *Service) resolveExternalSessionFromIdentity(ctx context.Context, identity *authn.Identity, userID int64) *auth.ExternalSession {
-	if identity.OAuthToken == nil {
+	if identity.OAuthToken == nil && identity.SAMLSession == nil {
 		return nil
 	}
 
@@ -506,18 +506,26 @@ func (s *Service) resolveExternalSessionFromIdentity(ctx context.Context, identi
 		UserAuthID: info.Id,
 		UserID:     userID,
 	}
-	extSession.AccessToken = identity.OAuthToken.AccessToken
-	extSession.RefreshToken = identity.OAuthToken.RefreshToken
-	extSession.ExpiresAt = identity.OAuthToken.Expiry
 
-	if idToken, ok := identity.OAuthToken.Extra("id_token").(string); ok && idToken != "" {
-		extSession.IDToken = idToken
+	if identity.OAuthToken != nil {
+		extSession.AccessToken = identity.OAuthToken.AccessToken
+		extSession.RefreshToken = identity.OAuthToken.RefreshToken
+		extSession.ExpiresAt = identity.OAuthToken.Expiry
+
+		if idToken, ok := identity.OAuthToken.Extra("id_token").(string); ok && idToken != "" {
+			extSession.IDToken = idToken
+		}
+
+		// As of https://openid.net/specs/openid-connect-session-1_0.html
+		if sessionState, ok := identity.OAuthToken.Extra("session_state").(string); ok && sessionState != "" {
+			extSession.SessionID = sessionState
+		}
+
+		return extSession
 	}
 
-	// As of https://openid.net/specs/openid-connect-session-1_0.html
-	if sessionState, ok := identity.OAuthToken.Extra("session_state").(string); ok && sessionState != "" {
-		extSession.SessionID = sessionState
-	}
+	extSession.SessionID = identity.SAMLSession.SessionIndex
+	extSession.NameID = identity.SAMLSession.NameID
 
 	return extSession
 }
diff --git a/pkg/services/authn/identity.go b/pkg/services/authn/identity.go
index e137809c1d2..a072ee7d807 100644
--- a/pkg/services/authn/identity.go
+++ b/pkg/services/authn/identity.go
@@ -64,6 +64,8 @@ type Identity struct {
 	Groups []string
 	// OAuthToken is the OAuth token used to authenticate the entity.
 	OAuthToken *oauth2.Token
+	// SAMLSession is the SAML session information.
+	SAMLSession *login.SAMLSession
 	// SessionToken is the session token used to authenticate the entity.
 	SessionToken *usertoken.UserToken
 	// ClientParams are hints for the auth service on how to handle the identity.
diff --git a/pkg/services/login/model.go b/pkg/services/login/model.go
index b11ec2161f3..3d755a80301 100644
--- a/pkg/services/login/model.go
+++ b/pkg/services/login/model.go
@@ -27,6 +27,7 @@ type UserAuth struct {
 
 type ExternalUserInfo struct {
 	OAuthToken     *oauth2.Token
+	SAMLSession    *SAMLSession
 	AuthModule     string
 	AuthId         string
 	UserId         int64
@@ -40,6 +41,11 @@ type ExternalUserInfo struct {
 	SkipTeamSync   bool
 }
 
+type SAMLSession struct {
+	NameID       string
+	SessionIndex string
+}
+
 func (e *ExternalUserInfo) String() string {
 	isGrafanaAdmin := "nil"
 	if e.IsGrafanaAdmin != nil {