thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

SAML vs OAuth vs OpenID Connect: What's the Difference?

SAML is an XML-based standard for exchanging authentication assertions, mainly for enterprise web SSO. OAuth 2.0 is an authorization framework that grants delegated access to APIs via tokens, and OpenID Connect adds an identity layer on top of OAuth 2.0 to provide authentication.

vsvs

OpenID Connect (OIDC)

Full definition
SAMLOAuth 2.0OpenID Connect
Primary purposeAuthentication and SSODelegated authorizationAuthentication on top of OAuth
Data formatXML assertionsAccess tokens (often JWT, format not mandated)JSON ID token (JWT) plus OAuth tokens
Typical useEnterprise web SSO to SaaS appsLetting an app access your data without your passwordSocial and modern app login, mobile
AnswersWho is the user?What can this app access?Who is the user, in an OAuth flow?
Mobile/API friendlinessWeakerStrongStrong
Key componentsIdP, SP, assertionResource owner, client, authorization server, resource serverOpenID Provider, relying party, ID token
Remember it

SAML says who you are in XML, OAuth says what an app may do, OIDC says who you are in OAuth's language.

Exam tip

A classic trap: OAuth alone is not an authentication protocol. If the scenario is granting a third-party app limited access to an API, choose OAuth.

Tested on

More Security Fundamentals & Crypto look-alikes