3 ms·

SAML is a middle tier between the endpoint (user app) and directory (ADFS, LDAP, etc.) and not a single solution on it's own, it doesn't store data - it provide

SAML is a middle tier between the endpoint (user app) and directory (ADFS, LDAP, etc.) and not a single solution on it's own, it doesn't store data - it provides a means for leveraging that data defined by the schema (e.g. posixAccount and groupMember). It's generally equivalent to pam_sss, nss-pam-ldap and friends at the systems layer of your average Linux. They are complementary, not replacements for each other.

derefr 7y ago
The difference is that, in practice, if you're "just" a large non-IT enterprise or "just" a cloud provider, then you're not implementing the whole solution any more, only half of it. If you're, say, Box, you're implementing only the endpoint, and mostly don't need your own directory, because all your customers bring their own. If you're, say, IBM, you're implementing only the raw directory, but rely on cloud providers to actually interpret it, rather than hosting any of your own Intranet. And if you're Joe SMB, then you're implicitly using GSuite as your SAML-exposed directory through OpenID Connect, and you don't need an IT department for this at all. (And even if you're an enterprise who also writes your own cloud services, then this is still a change for you, because your endpoints are probably now written "generically" with a SAML interface—treating your own directory as just one among many, talking to it through a public exposure—rather than interfacing directly to it as a privately-configured PAM binding on your servers et al. In other words, now your services [and the departments providing them] are decoupled from your directory, because they both just see each-other through the lens of SAML, and so don't know that your company's employees are any different than a client company's employees.)
- gravitas 7y ago
  My 5k-10k person company directly refutes your parenthesized comment, you are making incorrect assumptions about how everyone runs their businesses.

derefr 7y ago

The difference is that, in practice, if you're "just" a large non-IT enterprise or "just" a cloud provider, then you're not implementing the whole solution any more, only half of it. If you're, say, Box, you're implementing only the endpoint, and mostly don't need your own directory, because all your customers bring their own. If you're, say, IBM, you're implementing only the raw directory, but rely on cloud providers to actually interpret it, rather than hosting any of your own Intranet. And if you're Joe SMB, then you're implicitly using GSuite as your SAML-exposed directory through OpenID Connect, and you don't need an IT department for this at all. (And even if you're an enterprise who also writes your own cloud services, then this is still a change for you, because your endpoints are probably now written "generically" with a SAML interface—treating your own directory as just one among many, talking to it through a public exposure—rather than interfacing directly to it as a privately-configured PAM binding on your servers et al. In other words, now your services [and the departments providing them] are decoupled from your directory, because they both just see each-other through the lens of SAML, and so don't know that your company's employees are any different than a client company's employees.)

gravitas 7y ago
My 5k-10k person company directly refutes your parenthesized comment, you are making incorrect assumptions about how everyone runs their businesses.