Downloaded 618 times
Uploaded byAnil Saldanha
Saml vs Oauth : Which one should I use?
SAML and OAuth are both standards for authentication and authorization but have key differences. SAML is an XML standard that enables single sign-on, federation, and identity management through security assertions. OAuth is a standard for authorization that allows secure access to internet resources without sharing passwords. While SAML uses XML tokens and supports SOAP/JMS transport, OAuth uses HTTP and JSON/binary tokens. SAML is commonly used for enterprise SSO and identity federation, while OAuth is designed for authorization of internet resources from applications. The document recommends using SAML for SSO and OAuth for delegated access to resources.
More Related Content
Similar to Saml vs Oauth : Which one should I use?
![[4developers2016] - Security in the era of modern applications and services (...](https://cdn.slidesharecdn.com/ss_thumbnails/4developers2016-modernappsecurity-160601100135-thumbnail.jpg?width=640&height=640&fit=bounds)
Saml vs Oauth : Which one should I use?
- 1. SAML vs OAuth AnilSaldhana anil@apache.org http://anil-identity.blogspot.com Reference: http://architects.dzone.com/articles/saml-versus-oauthwhich-one
- 2.
- 3. Informal Definitions • SAML(Security Assertion Markup Language) is an umbrella standard that encompasses profiles, bindings and constructs to achieve – Single Sign On (SSO), – Federation and – Identity Management.
- 4. Informal Definitions • OAuth(Open Authorization) is a standard for authorization of resources. • It does not deal with authentication. – Look for OpenID Connect for Authentication.
- 5.
- 6. Formal Definitions • SecurityAssertion Markup Language is an XML-based open standard data format for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. • From Wikipedia Page on SAML
- 7. Formal Definitions • OAuth: An open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications. • From OAuth.net
- 8.
- 9. Token or MessageFormat
- 10. Token Or MessageFormat • SAML deals with XML as the data construct or token format. • OAuth tokens can be binary, JSON or SAML as explained in OAuth Bearer Tokens (https://docs.jboss.org/author/display/PLINK/ OAuth+Bearer+Tokens).
- 11.
- 12. Transport • SAML hasBindings that use HTTP such as HTTP POST Binding, HTTP REDIRECT Binding etc. – But there is no restriction on the transport format. You can use SOAP or JMS or any transport you want to use to send SAML tokens or messages.
- 13. Transport • OAuth usesHTTP exclusively.
- 14.
- 15. Scope • Even thoughSAML was designed to be applicable openly, it is typically used in Enterprise SSO scenarios – within an enterprise or – enterprise to partner or – enterprise to cloud scenarios.
- 16. Scope • OAuth hasbeen designed for use with applications on the internet, – primarily for delegated authorization of internet resources. • OAuth is designed for Internet Scale.
- 17. Which Versions ShouldBe Used?
- 18. Versions • SAML v2.0 •OAuth v2.0
- 19.
- 20. Use Cases • Ifyour use case involves SSO (when at least one actor or partner is an enterprise) – then use SAML.
- 21. Use Cases • Ifyour use case involves providing access (temporarily or permanent) to resources (such as accounts, pictures, files etc.) – then use OAuth.
- 22. Use Cases • Ifyour use case involves providing access to a partner or customer application to your portal – then use SAML.
- 23. Use Cases • Ifyour use case requires a centralized identity source – then use SAML. You can also use an Open ID Provider as a central Identity Provider under the OpenID Connect Specification (under development).
- 24. Use Cases • Ifyour use case involves mobile devices – then use OAuth (with some form of bearer tokens).
- 25. Using SAML withOAuth
- 26. SAML With OAuth •Use SAML for authentication. • Use SAML token/assertion as the OAuth bearer token in the HTTP bearer header to access protected resources.
- 27. Replace SAML withOAuth
- 28. Replace SAML WithOAuth • Use JWT for authentication. • Use JWT as the OAuth bearer token in the HTTP bearer header to access protected resources.
- 29.
- 30. References • PicketLink :http://www.picketlink.org • IETF OAuth2 (http://datatracker.ietf.org/doc/rfc6749/) • OpenID Connect http://openid.net/specs/openid-connectbasic-1_0-22.html
- 31.
- 32.