Federation: SAML, OAuth 2.0, OIDC
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
choose the right protocol per integration.
Planned topics
- SAML: XML-based sign-in standard, common for enterprise SaaS and older apps.
- OAuth 2.0: delegated authorization: an app gets limited access to an API on a user's behalf; it is not itself a sign-in protocol.
- OpenID Connect (OIDC): sign-in layer on top of OAuth 2.0, using JSON tokens; the default for new web and mobile apps.
- Choose by what the integration supports: SaaS that only speaks SAML gets SAML; new apps and APIs use OIDC and OAuth 2.0.
- Mobile apps use the authorization code flow with PKCE; no secrets in the app.
Draft outline details
Demonstration
a decision table: integration, protocol, reason (staff SSO to SaaS HR tool: SAML; mobile app login: OIDC; partner API access: OAuth 2.0 client credentials).
Check your understanding
Which protocol is built for sign-in on top of OAuth 2.0?
Show answer
OpenID Connect.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.