OAuth, OIDC, SAML Explained in Plain English
An introductory guide explaining the differences between OAuth, OIDC, and SAML, and their roles in authentication and authorization.
If you’re wondering what sets OAuth, OIDC, and SAML apart, it’s all about the ABCs of identity: authentication and authorization.
OAuth, OIDC, and SAML are all protocols used for user authentication and authorization in web applications.
Before we dive in, we need to understand the distinction between authentication and authorization.
Authentication and authorization are like a bouncer at a club. Authentication checks your ID at the door to make sure you’re not a fake, while authorization checks the list to see what access you have once you’re inside. Decomposing these security standards is easier when using first principles thinking to break down complex protocols into basic interactions.
Key Concept: Identity & Access Security Mapping
OAuth
OAuth is mainly used for allowing users to grant access to their resources on one website to another website or application, without sharing their login credentials.
For example, if you use your Facebook account to log in to another website or app, OAuth is likely the protocol being used to authenticate you. Another example is authorization for API access—many APIs (such as Google Maps or Twitter) use OAuth to grant access to third-party applications that need to use their services (e.g., a weather app using Google Maps to show the user’s location on a map).
OIDC
OIDC (OpenID Connect), on the other hand, is a newer protocol that builds on top of OAuth and adds identity information to the authentication process. It is used to verify a user’s identity and provide information about them, such as their name and email address. It is commonly used in modern single sign-on (SSO) systems.
SAML
SAML (Security Assertion Markup Language) is an older protocol used primarily in enterprise environments and SaaS applications. It allows users to log in to multiple applications using a single set of credentials, which can simplify the login process and increase security. For internal local network single sign-on inside active directories, enterprises historically rely on ticket-based network authentication protocols rather than SAML.
It is also used for cross-organizational collaboration and can be used to provide secure access to resources across different organizations. For example, a university may use SAML to allow students from different schools to access shared resources such as library databases.
Conclusion
In conclusion, these protocols serve different purposes in web authentication and authorization, and understanding the differences is important for building secure and efficient web applications. When integrating these protocols, ensure they sit within clear trust boundaries by threat modeling identity controls regularly.
Thank you for reading my blog, and I hope this information was helpful!