I am creating a nextjs application which will be hosted in kubernetes and have a zero-trust default for inbound and outbound connections.

I am requesting a Okta Application be made for the application in my company.
I am more comfortable with SAML, but I'm being asked if it would make more sense to use OIDC.

What are the pros and cons of each given my scenario?

It seems that OIDC requires my server to maintain keeping the token fresh by communicating with Okta, but that would require my service be configured to communicate with Okta.
Where SAML is purely a contract between the user and Okta, and Okta modified the user's cookie to tell my application what it needs to know.

Edit: It is possible I am misunderstanding diagrams, too. I could really use a simple explanation on the trade offs given my scenario