{"id":212,"date":"2025-03-07T15:29:45","date_gmt":"2025-03-07T15:29:45","guid":{"rendered":"https:\/\/discovery.cevolution.co.uk\/ciam\/?p=212"},"modified":"2026-03-13T11:13:52","modified_gmt":"2026-03-13T11:13:52","slug":"oidc-saml-and-oauth-2-0","status":"publish","type":"post","link":"https:\/\/discovery.cevolution.co.uk\/ciam\/2025\/03\/07\/oidc-saml-and-oauth-2-0\/","title":{"rendered":"OIDC, SAML and OAuth 2.0"},"content":{"rendered":"Reading Time: <\/span> 9<\/span> minutes<\/span><\/span>\n

Many developers have encountered the terms OIDC<\/span>, SAML<\/span> and OAuth 2.0<\/span>. However, hearing about them and knowing what they are, as well as when to use them, are different things.<\/p>\n\n\n\n

For instance, can you say which are protocols primarily intended for Authorization<\/a> and which should be used for Authentication<\/a>? Which protocols only support Browser-based workflows and which provide other workflow mechanisms, too? Which produces a JWT<\/span> and which produces an Assertion?<\/p>\n\n\n\n

Whilst I don’t necessarily disagree with @JustDeezGuy (below) \u2014 particularly the part “…and you shouldn’t rely on third-party SDKs<\/span>…<\/em>” \u2014 Auth, with all its various permutations and combinations, isn’t exactly as easy as @Ashref might lead folks to believe. Read my Build, Buy or DIY<\/a><\/em> post if you want to know more about my thoughts on the matter.<\/p>\n\n\n\n

\n
\n

I wouldn't put it quite this harshly, but it IS true there are ~2 relevant standards, OIDC and SAML, and you shouldn't rely on third-party SDKs (I'm looking at you, Okta, Auth0…) for them.

Working with literally any conformant OIDC or SAML system is not hard. https:\/\/t.co\/smejiN6P8I<\/a><\/p>— Paul Snively (@JustDeezGuy) November 23, 2024<\/a><\/blockquote>