Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Federated vs. Delegated, OAuth vs OpenID Connect vs SAML

I am trying to understand differences between Federated Authentication and Delegated Authentication, But I am getting more and more confused.

  1. Do we use SAML protocol ALWAYS for Federated Authentication? or What?

  2. Is it possible to use OpenID Connect (or OAuth) for both authentication methods?

  3. Do we need to have Trusted connection between two domains to be able to have Delegated or Federated authentication?

  4. Do we always use SAML for Partners and OpenID Connect (or OAuth) for Customers?

  5. I will be grateful if somebody explains different steps for these two authentication methods between two domains (Partners and Enterprise).

like image 444
user217648 Avatar asked Oct 24 '17 12:10

user217648


People also ask

What is the difference between SAML and OAuth and OpenID?

The primary difference between SAML vs. Oauth vs. OpenID is that Oauth is a framework that controls authorization to protected resources like applications or groups of files. OpenID Connect and SAML, on the other hand, are industry standards for federated authentication.

Is OpenID Connect better than SAML?

It is much simpler to implement than SAML and easily accessible through APIs because it works with RESTful API endpoints. This also means it works much better with mobile applications.

What is the difference between SAML and OpenID Connect?

In SAML, the user is redirected from the Service Provider (SP) to the Identity Provider (IDP) for sign in. In OpenID Connect, the user is redirected from the Relying Party (RP) to the OpenID Provider (OP) for sign in. The SAML SP is always a website.

Is SAML the same as OpenID?

OpenID lacks user authorization data (such as permissions) and focuses primarily on identity assertion. SAML is an identity data exchange and is very feature-rich. Authentication is decentralized with OpenID. SAML uses assertions versus the OpenID and OAuth architecture of ID tokens.


1 Answers

A difference between the two methods are:

A delegated solution means that one site is simply outsourcing its authentication needs to another pre-selected site. If your site uses Facebook Connect, you are delegating your authentication facilities to Facebook. Visitors to your site cannot use any other accounts, only accounts from the vendors you have pre-selected.

A federated solution means that visitors to your site can use any account they have, as long as it is compatible. It makes no difference to the site which account is being used, as long as it can interoperate. At its core, OpenID is a federated solution because its most important feature is the ability to use any OpenID account with any OpenID-enabled service.

Source

Now to your questions:

  1. Not only SAML but OpenId Connect, OAtuh2 or even others protocols can be used as well.
  2. Yes. Just note that delegated solution is less secure.
like image 50
Albert Avatar answered Oct 18 '22 21:10

Albert