5 ms·
Seems pretty good although it'd be good to callout OpenIDC as a predecessor to SAML. OpenIDC is pretty widely supported with the added benefit of not having to
by nijave 1y ago
Seems pretty good although it'd be good to callout OpenIDC as a predecessor to SAML. OpenIDC is pretty widely supported with the added benefit of not having to deal with certificate expiry.
- SahAssar 1y ago> it'd be good to callout OpenIDC as a predecessor to SAML SAML is older than OpenID Connect by ~13 years.
- nijave 1y agoWhoops meant successor :facepalm:
- jpc0 1y agoOIDC does not in any way offer the same functionality as SCIM and SAML. SAML is approximately OIDC + SCIM + Legacy Cruft
- OkayPhysicist 1y agoWhat is the extra stuff that is provided compared to OIDC? I was implementing some of this stuff recently, and for my use case (who is this user? Do they have permission to use this application? Which parts of the application are they allowed to use?) OIDC seemed to cover everything, so I'm pretty curious if I missed some functionality that SAML provides.
- jpc0 1y agoCreating the user in your application before first logon. Removing the user from your application immediately and not when their session eventually expires. Doing those things in batch. Querying that data at will to produce reports. Updating a users group membership when needed and immediately and not when you decide to do so. And then you only need an opaque userid from me and not a fat OIDC token that knows everything about my internal structure.
- maxwellg 1y agoThese are all features of SCIM, not of SAML. SAML only communicates user metadata on login. SCIM can be used with both SAML and OIDC.
- jpc0 1y agoYou may be correct there. I seem to remember being able to handle that over SAML but could be an extension… Regardless OIDC is authentication not authorisation. OIDC asserts who you are not what you are allowed to do, where SAML asserts what as well as who. I mean you could hack assertions into scopes somehow and return it in the OIDC token but that’s not really standardised and everyone will just decide what they are going to add whenever they want which is at best no better than SAML using JS instead of XML.
- T-Winsnes 1y agoSAML allows you to send additional attributes with the identity payload, like group memberships. This is not inherently authorisation, but can be used to automatically map users to teams/groups/roles in your application. SAML is a very complicated standard, and very painful to implement. OIDC is much simpler, but lacks some of the capabilities. Both can automatically create users on login, that is application implementation detail. Both also need SCIM or something similar to offboard users
- deathanatos 1y ago> SAML allows you to send additional attributes with the identity payload, like group memberships. This is how OIDC does it, too; group membership is a claim.
- lll-o-lll 1y agoThe authorization model is bespoke to your ecosystem. Whether you do that with claims, scopes or assertions is irrelevant. None of these are hacks, but they can’t be simply standardized either. Provisioning/Deprovisioning is a separate concern; SCIM is one way (but just in time provisioning can also be achieved with both solutions). There’s no reason to choose SAML other than for legacy integration.
- deathanatos 1y agoYou're putting words in their mouth by adding in SCIM.
- jpc0 1y ago> SAML is approximately OIDC + SCIM + Legacy Cruft I believe I added sufficient context for why I added SCIM into the mix.