Home › Identity & Access Management
SAML vs OAuth vs OpenID Connect: Federated Identity Explained
Identity & Access ManagementCISSPSecurity+CySA+
How can you sign in to an app that belongs to another organization, without giving that app your password? In this video, I'll walk through federated identity and the three standards behind it: SAML for browser single sign-on, OAuth 2.0 for giving an app limited access, and OpenID Connect for signing in with an account you already have, with one example for each and the tokens they use.
What you will learn
- Federated identity (FIM): the user, the identity provider (IdP) and the relying party
- SAML 2.0: the sign-in flow, the signed assertion and its statements, and the four components
- OAuth 2.0: the four roles, consent and scopes, the authorization code, and the access token
- Current OAuth practice: RFC 9700, no implicit flow, PKCE, and the OAuth 2.1 draft
- OpenID Connect (OIDC): sign-in with the openid scope, and the ID token as a JSON Web Token (JWT)
- Authentication vs authorization: which question SAML, OAuth and OIDC each answer
- Three tip ideas: OAuth ≠ authentication; access token ≠ ID token; trusted IdP ≠ no risk