4 ms·

> To put it simply, it’s the enterprise equivalent of the “Login with Google” or “Login with Facebook” buttons we see in apps around the internet. This is a li

> To put it simply, it’s the enterprise equivalent of the “Login with Google” or “Login with Facebook” buttons we see in apps around the internet. This is a little pedantic since the original article is from 2020 when using SAML might have still been worthwhile to invest time into... But today OpenID Connect (OIDC) is the Enterprise equivalent of these features, or rather these products from major vendors are each just their implementations of OpenID Connect. If you have the choice, you should probably be looking at OIDC instead of SAML for federated identity today.

noddingham 2y ago
Not saying you're wrong, I only want to add to your context by saying (in my experience) within higher education SAML is the way federated identity is done. InCommon has been around for a long time and makes it pretty easy, and Shibboleth is very popular. Have a great day!
- gorkish 2y ago
  Being around longer or being widely implemented within some market segment is not a great reason to advocate for expanding its use. I could play devil's advocate for Kerberos or NIS just as easily as you can for SAML. It's fine if you must integrate with an existing system, but it's instant tech debt if you build a new system around it today.
  - barryrandall 2y ago
    Nothing else is suitable for multilateral, full-mesh federation yet. The OIDC multilateral federation standard hasn't been finalized or fully implemented yet, and it takes years to coordinate this kind of change in a federation.
    - gorkish 2y ago
      So use SAML for that part; education is still a big market and they have a case for delegating the responsibility of establishing and managing trust relationships to a federation provider that most b2b and b2c applications will not have. Fortunately most of these identity systems are happy to proxy for downstream OIDC/OAuth IdCs anyway, so the argument that you may not want to implement SAML IdC in your own application is still valid even in this context.
nunez 2y ago
Many big companies are still using SAML auth, unfortunately.

noddingham 2y ago

Not saying you're wrong, I only want to add to your context by saying (in my experience) within higher education SAML is the way federated identity is done. InCommon has been around for a long time and makes it pretty easy, and Shibboleth is very popular. Have a great day!

gorkish 2y ago
Being around longer or being widely implemented within some market segment is not a great reason to advocate for expanding its use. I could play devil's advocate for Kerberos or NIS just as easily as you can for SAML. It's fine if you must integrate with an existing system, but it's instant tech debt if you build a new system around it today.
- barryrandall 2y ago
  Nothing else is suitable for multilateral, full-mesh federation yet. The OIDC multilateral federation standard hasn't been finalized or fully implemented yet, and it takes years to coordinate this kind of change in a federation.
  - gorkish 2y ago
    So use SAML for that part; education is still a big market and they have a case for delegating the responsibility of establishing and managing trust relationships to a federation provider that most b2b and b2c applications will not have. Fortunately most of these identity systems are happy to proxy for downstream OIDC/OAuth IdCs anyway, so the argument that you may not want to implement SAML IdC in your own application is still valid even in this context.

nunez 2y ago

Many big companies are still using SAML auth, unfortunately.