All geek questions in one place

SAML 2.0 vs OpenID

Given that SAML 2.0 supports the concept of federation, and given that well-known players like Google use SAML, can anyone explain why some other services (like stackoverflow) use OpenID? Is this just a historical reason?

+6
source share
2 answers

First I have to say that Google is a SAML provider as well as an OpenID provider.

In the case of stackoverflow, if they want to use SAML 2.0 for SSO, then they need to associate stackoverflow with Google or any other SAML provider in advance. And when stackoverflow is associated with many SAML providers, when a user tried to log in, stackoverlow needs a mechanism to figure out to whom the identity provider should redirect the user to authentication. (you can use SAML 2.0 profiles, section 4.3 "Identity Provider Discovery Profile"). But in any case, it will be a painful implementation.

But with OpenID, it has its own discovery profile, stackoverflow should not know the Identity Provider in advance, without a direct connection. Therefore, they use the correct protocol.

+7
source

As far as I know:

OpenID allows a website (stackoverflow) to use an identifier from various OpenID providers (and it is not shared)

SAML (/ w federation) allows you to use Identity for different service providers / websites.

+1
source

Source: https://habr.com/ru/post/928062/

More articles:


All Articles