Comparisons

SAML or OpenID Connect: which one to choose?

Both provide single sign-on, but not with the same tools. Here are the differences that matter when choosing.

In short

SAML is the historical standard for enterprise applications: XML, signed assertions, browser only. OpenID Connect (OIDC) is more recent: JSON, JWT tokens, APIs, mobile and modern web applications.

SAML 2.0OpenID Connect
FormatXML (signed assertion)JSON (JWT ID token)
TransportRedirect or POST in the browserRedirect then direct HTTP calls (token, userinfo)
Mobile applications and APIsPoorly suitedDesigned for it
DiscoveryXML metadata to exchangeThe .well-known/openid-configuration document
LogoutSLO, often fragileRP-initiated logout, back-channel
Typical useEnterprise applications (SaaS, intranet)Web, mobile applications, APIs
Implementation difficultyXML signatures, certificates, clocksRedirect URI, scopes, PKCE

How to choose

  • Your customer or product requires SAML: choose SAML.
  • You are building a new application, with mobile or API: choose OIDC.
  • The two often coexist: a single identity provider can speak both.
Test SAMLTest OpenID ConnectOAuth 2.0 or OIDC?