Modern Identity: SAML, OIDC, and Hybrid Approaches

Security Assertion Markup Language 2.0 (SAML) is an XML-based open standard for Single Sign-On in enterprise environments. Standardized in 2005, SAML allows an Identity Provider (IdP) to issue digitally signed XML assertions to Service Providers (SPs), enabling users to authenticate once and access multiple services without re-entering credentials.

In SAML, the Identity Provider (IdP) is the authority that authenticates users and issues assertions. Examples: Okta, Microsoft Entra ID, PingFederate. The Service Provider (SP) is the application that relies on the IdP's assertion. Examples: Salesforce, Workday, ServiceNow. The SP trusts the IdP's signature to grant access.

SAML assertions must be digitally signed by the IdP using an RSA or EC key pair, allowing the SP to verify authenticity. Assertions can also be encrypted for confidentiality in transit. The SP must validate the signature, check the assertion's NotBefore and NotOnOrAfter timestamps, and verify the audience restriction to prevent replay attacks.

OpenID Connect (OIDC) is a modern identity layer built on OAuth 2.0 that serves the same SSO purpose as SAML but uses JSON and JWTs instead of XML. Published in 2014, OIDC is better suited for mobile apps, single-page applications, and REST APIs, while SAML remains dominant in traditional enterprise web applications.

OIDC extends OAuth 2.0 by adding an ID token (a JWT containing identity claims) to the OAuth 2.0 authorization flow. OAuth 2.0 handles authorization (delegated access to APIs), while OIDC adds authentication (verifying user identity). OIDC requires the openid scope and returns an ID token alongside the OAuth access token.

Microsoft Entra ID (formerly Azure Active Directory) is a cloud-native identity provider that supports both SAML and OIDC/OAuth 2.0 for federated SSO. It can synchronize with on-premises Active Directory via Entra Connect, providing hybrid identity management where both cloud and on-premises resources share a single identity directory.

Active Directory Federation Services (AD FS) is Microsoft's on-premises federation server that publishes SAML and WS-Federation endpoints for on-premises Active Directory. AD FS bridges legacy SAML-based applications with Active Directory credentials, and in hybrid deployments it federates with Entra ID to extend SSO to cloud applications.

System for Cross-domain Identity Management (SCIM) is a REST API standard for automating user provisioning and de-provisioning across identity systems and applications. When a new employee is added to Entra ID or Okta, SCIM automatically creates corresponding accounts in connected SaaS applications, and removes them when the employee leaves.

Modern identity providers implement conditional access policies that evaluate risk signals (device compliance, location, user behavior) before granting access. These policies can require step-up multi-factor authentication for sensitive resources. Combined with OIDC or SAML SSO, conditional access provides adaptive security without re-authentication friction.

Zero Trust architecture treats network location as irrelevant to access decisions: no implicit trust is granted based on being inside a corporate network. Instead of Kerberos perimeter authentication, Zero Trust uses continuous identity verification, device health checks, and least-privilege access policies enforced at every resource access request via OIDC or SAML.

Use SAML for legacy enterprise applications that were built before 2014 and already support SAML. Use OIDC for new applications, mobile apps, SPAs, and APIs. Both are supported by major IdPs, so the choice often depends on the application's existing support rather than security differences. OIDC is the preferred choice for all new development.

Which statement correctly describes a key difference between SAML and OIDC?

SAML 2.0 provides XML-based SSO for traditional enterprise apps. OIDC adds identity to OAuth 2.0 using JWT tokens and is preferred for modern apps. Entra ID supports both as a hybrid cloud IdP. AD FS bridges on-premises AD to SAML-based apps. SCIM automates provisioning. Zero Trust replaces perimeter-based Kerberos with continuous, policy-driven identity verification.