SAML vs OAuth - What’s the difference?

In a time when users need access to multiple platforms and resources, remembering multiple unique passwords can add friction to the user experience. That’s where SAML and OAuth come in. SAML and OAuth are open-standard protocols that enable user authentication and authorization of applications and resources.

While SAML is responsible for authentication, enabling Single Sign-On (SSO), and communicating between an Identity Provider (IdP) and a Service Provider (SP), OAuth uses tokens to authorize users, granting access to resources or APIs on a user’s behalf.

When used together, both these protocols enable organizations to build a secure, cohesive system for granting access and permissions to protected resources.

Security Assertion Markup Language (SAML) is a secure and standardized way of authenticating and authorizing data and identities between parties. SAML is an XML-based open standard that allows identity data to be communicated between two parties: identity and service providers.

SAML is used to make Single-Sign-On (SSO) possible, which allows users to verify and authenticate their identity one time. SSO then allows users to gain access to a variety of applications, platforms, and services without having to log in to each one.

There are three key parties involved in SAML-based authentication:

• The principal: this is the user attempting to access an application and is sometimes called the subject.
• Identity Provider (IdP): the service that stores and validates the user’s identity and grants authentication.
• Service Provider (SP): the application or service the user wants access to and who trusts the IdP and grants access.

In this scenario, the user logs in once with an IdP. The IdP shares the SAML characteristics with an SP each time a user attempts to gain access. This process enables the communication between IdPs and SPs through SAML and makes it possible for users to only use their login credentials one time.

OAuth (a.k.a open authorization) is an open-standard framework that enables third-party apps to access a user’s account securely without giving access to a user’s sensitive information, such as their password.

OAuth works by delegating authorization to the platform that hosts a user’s account. Third-party apps are then able to gain access to limited information regarding that user’s account for a variety of uses.

Roles are an essential part of the OAuth protocol, which are broken down into four categories:

• Resource Owner: this is the user that authorizes an application to access their account.
• Resource Server: this is the server hosting a user’s account or data.
• Client: this is the app that requests access to a user’s account or data. In order for the client to gain access, the user account must grant access and an API must validate it too.
• Authorization Server: the server is used to verify the user’s identity and provide an access token to the application.

SAML and OAuth are both used in the context of access management and eliminate the need for users to remember a never-ending list of login credentials. Both SAML and OAuth are open standard frameworks that enable SSO and support federated identity management (FIM).

But, there are a number of key differences between SAML and OAuth, mainly based on the fact that they involve different functions.

SAML and OAuth can be used interchangeably and at the same time. SAML can be used to authenticate a user, giving them access to an application, while OAuth can be used to set user privileges in applications and services in a network.

Although there are key differences between SAML and OAuth, when used in conjunction with one another, both can provide various benefits to a company. SAML can enable users to gain access to necessary applications, while OAuth can be used to provide access to protected resources in a safe, secure way.

See how Kinde compares to other authentication providers.