SAML vs federated login with OAuth

up vote31down votefavorite 12	What's the difference between SAML and federated login with OAuth? Which solution makes more sense, if a company wants to use a third-party webapp, and but also wants single sign-on and be the authentication authority? authentication oauth saml share|improve this question asked May 14 '10 at 20:53 Chung Wu 5272514

2 Answers

activeoldestvotes

up vote39down voteaccepted

They solve different problems. SAML is a set of standards that have been defined to share information about who a user is, what his set of attributes are, and give you a way to grant/deny access to something or even request authentication. OAuth is more about delegating access to something. You are basically allowing someone to "act" as you. Its most commonly used to grant access api's that can do something on your behalf. They are two completely different things. Some examples that might help out. OAuth think of an twitter. Lets say you are using buzz and twitter, and you want to write an app to be able to sync the two. You basically can establish trust between your app and twitter. First time you go to link the app to twitter, you do the classic prompt to log into twitter, and then that confirmation box pops up and asks "Would you like to grant access to <>?" once you click yes, the trust has been established, and now your app can act as you on twitter. It can read your posts, as well as make new ones. SAML - For SAML think of some type of "agreement" between two unrelated membership systems. In our case we can use US Airways and Hertz. There is no shared set of credentials that can take you from one site to another, but lets say Hertz wants to offer a "deal" to US Airways. (Granted i know this is an extreme example, but bare with me). After buying a flight, they will offer a free rental car to its Chairman members. US Airways and Hertz would setup some form of trust, and some way to identify the user. In our case our "federated id" would be the email address, and it would be a one way set of trust Hertz trusts that US Airways identity provider will deliver a token that is accurate and in a secure manner. After booking the flight US Airways identity provider would generate a token and populate how they have authenticated the user, as well as "attributes" about the person in our case the most important attribute would be his status level in US Airways. Once the token has been populated it passes it via some type of reference, or encoded in a url and once we get to Hertz, it looks at the token, validates it and now can allow for the free rental car. The problem with this SAML example is its only one specialized use case out of many. SAML is a standard and there are almost too many ways that you can implement it. Alternatively if you dont care about authorization, you could almost argue that asserting authentication via SAML and OpenID.