SSO in plain language: SAML vs OAuth and OIDC

Single Sign-On (SSO) simplifies the process of logging into multiple applications by proving your identity once. The problem it solves is that having 40 apps means managing 40 passwords, which often leads to password reuse across services—making accounts vulnerable.

The Problem SSO Solves

People frequently use the same password for multiple applications due to the sheer number of login credentials required. Single Sign-On (SSO) allows you to prove your identity once to an Identity Provider (IdP), and every application trusts this proof instead of maintaining its own user authentication system.

The Cast

Identity Provider (IdP): The entity responsible for verifying your identity, such as Entera, Azure AD, Okta, Google Workspace, or self-hosted solutions like Authentik or Keycloak.
Service Provider (SP) / Relying Party: Applications that trust the IdP to authenticate users.

Protocols: SAML vs OAuth/OIDC

SAML (Security Assertion Markup Language)

SAML is an older protocol from 2005, based on XML. It works by bouncing the browser to the IdP for authentication, then returning with a signed XML assertion that each application trusts. This protocol is commonly used in enterprise environments.

Pros:

Battle-tested and feature-complete.
Suitable for workforce logins.
Widely supported in older enterprise software.

Cons:

Verbose and complex to debug due to its XML nature.
Less developer-friendly.

OAuth 2 + OIDC (OpenID Connect)

OAuth 2 is an authorization framework, while OpenID Connect (OIDC) adds a layer of identity verification on top. Tokens are JSON Web Tokens (JWTs), making them more developer-friendly and easier to work with. This protocol is the default for modern applications.

Pros:

Developer-friendly tokens.
Widely adopted in new applications and mobile apps.
Simplifies integration with web services.

Cons:

Less mature than SAML, but rapidly gaining adoption.

Plain Rule of Thumb

Older enterprise software typically uses SAML, while modern applications use OAuth 2 + OIDC. Good IdPs can support both protocols to accommodate different needs.

Pros and Cons of SSO

Pros:

Single Strong Password: Using one strong password plus Multi-Factor Authentication (MFA) in one place protects multiple accounts.
Leaver Management: Disabling an account at the IdP automatically removes access from all applications.
Fewer Password Reset Tickets: Reduces administrative overhead.
Per-App Passwords Vanish: Simplifies user experience.

Cons and Honest Risks:

Single Point of Failure: If the IdP is down or breached, it can affect all services. Mitigation strategies include MFA, break-glass admin accounts.
Setup Complexity Per App: Each application may require custom setup.
Maintenance Burden for Self-Hosted Solutions: Managing a self-hosted identity provider adds complexity.

Homelab Angle

Self-hosting an IdP like Authentik or Keycloak in front of your services (e.g., Jellyfin, Grafana) is a valuable learning project. It helps you understand SSO concepts and prepares you for real-world scenarios where this knowledge might be crucial.

Older Protocols: RADIUS and LDAP

For network gear and directories, RADIUS and LDAP are older protocols that serve similar purposes but are not the focus of this document. A separate doc will cover these in more detail.

This draft covers SSO concepts clearly, explaining the differences between SAML and OAuth/OIDC, their pros and cons, and provides a practical homelab angle for learning about identity management systems.