SAML vs. OAuth vs. OpenID Connect

This post was initially published on my blog. Check out the original source using the link below:

Authentication and Authorisation are crucial for ensuring the security of applications and data. Three widely-used protocols for managing these processes are OAuth, SAML, and OpenID.

When you use apps like Facebook, Google, or LinkedIn to log into other websites, you’re encountering some important protocols: OAuth, SAML, and OpenID Connect. These protocols help keep your information secure while allowing you to access different services.

1. SAML (Security Assertion Markup Language)

SAML is an open standard for exchanging authentication and authorization data between parties, particularly between an identity provider (IdP) and a service provider (SP). It is primarily used for single sign-on (SSO) scenarios, enabling users to authenticate once and gain access to multiple applications.

How SAML Works

Roles/Actors:

• User: The individual accessing the applications.

• Identity Provider (IdP): The service that authenticates the user and provides the identity assertions.

• Service Provider (SP): The application or service the user is trying to access.

Request Flow Diagram:

Key Features of SAML

• Single Sign-On (SSO): Users authenticate once for multiple services.

• XML-Based: Uses XML for messages, making it robust.

• Secure Assertions: Transmits user identity and attributes securely.

---

2. OAuth (Open Authorisation)

OAuth is an open standard for access delegation commonly used for token-based authentication and authorisation. It allows third-party applications to access user data without exposing their credentials. OAuth is primarily used for authorisation, enabling users to grant limited access to their resources hosted on one site to another site.

How OAuth Works

Roles/Actors:

• Resource Owner: The user who owns the data and grants access to it.

• Resource Server: The server hosting the user's data (e.g., Google, Facebook).

• Client: The third-party application requesting access to the user's data.

• Authorization Server: The server responsible for issuing access tokens to the client after authenticating the resource owner.

Request Flow Diagram:

Key Features of OAuth

• Delegated Access: Users can grant access without sharing credentials.

• Access Tokens: Short-lived tokens that limit access duration.

• Scopes: Define the extent of access granted to the client.

---

3. OpenID Connect

OpenID Connect is an authentication layer built on top of OAuth 2.0. It adds identity verification and provides a way for clients to verify the identity of the user based on the authentication performed by an Authorisation Server.

How OpenID Connect Works

Roles/Actors:

• End User: The user who wants to authenticate.

• Client: The application requesting user authentication.

• Authorisation Server: The server that authenticates the user and issues tokens.

Request Flow Diagram:

Key Features of OpenID Connect

• ID Tokens: JWTs that provide user information and claims.

• Seamless Integration with OAuth: Combines authentication and authorisation.

• User Info Endpoint: Allows fetching additional user information.

OpenID Connect and OAuth

Seems similar but they both serve different but complementary purposes:

• OAuth: Used for authorisation. It allows apps to access resources (like your profile or photos) from another service (e.g., Facebook or Google) without needing your password. Use OAuth when you want to grant limited access to your data (e.g., a third-party app accessing your calendar).

• OpenID Connect (OIDC): Built on top of OAuth, it's used for authentication. It verifies your identity and allows apps to know who you are. Use OpenID Connect when you need to log in to a website or app using a service like Google, proving who you are.

When to Use:

• Use OAuth:

  • When you want an app to access data or resources on your behalf (e.g., an app posting on Twitter for you).
  • "Can this app access my data?" (Authorisation)

• Use OpenID Connect:

  • When you need to verify a user's identity (e.g., signing into a website using your Google account).
  • "Who is this user?" (Authentication)

---

Quick Comparison of OAuth, SAML, and OpenID Connect

Conclusion

Understanding OAuth, SAML, and OpenID Connect is essential for building secure applications that handle user authentication and authorisation effectively. Each protocol has its purpose, ensuring you can access what you need while keeping your data safe.

References

1. OAuth 2.0 Explained Simply

2. What is SAML?

3. OpenID Connect Overview

4. Understanding the Differences: OAuth, SAML, and OpenID Connect