keycloak-scim/server_admin/topics/sso-protocols/saml-vs-oidc.adoc


=== OpenID Connect compared to SAML

Choosing between OpenID Connect and SAML is not just a matter of using a newer protocol (OIDC) instead of the older more mature protocol (SAML).

For most purposes, {project_name} recommends using OIDC.

SAML tends to be a bit more verbose than OIDC.

Beyond verbosity of exchanged data, if you compare the specifications you'll find that OIDC was designed to work with the web while SAML was retrofitted to work on top of the web.  For example, OIDC is also more suited for HTML5/JavaScript applications because it is
easier to implement on the client side than SAML. As tokens are in the JSON format,
they are easier to consume by JavaScript. You will also find several nice features that
make implementing security in your web applications easier. For example, check out the link:https://openid.net/specs/openid-connect-session-1_0.html#ChangeNotification[iframe trick] that the specification uses to easily determine if a user is still logged in or not.

SAML has its uses though. As you see the OIDC specifications evolve you see they implement more and more features that SAML has had for years. What we often see is that people pick SAML over OIDC because of the perception that it is more mature and also because they already have existing applications that are secured with it.
oidc/saml 2016-05-19 00:36:13 +00:00
KEYCLOAK-15771 Updates based on peer editing agreements on clients topics and making corrections to roles and groups chapter. 2020-11-17 20:40:14 +00:00			`=== OpenID Connect compared to SAML`
Update topics/sso-protocols/saml-vs-oidc.adoc 2016-06-10 04:38:24 +00:00
			`Choosing between OpenID Connect and SAML is not just a matter of using a newer protocol (OIDC) instead of the older more mature protocol (SAML).`

KEYCLOAK-15771 Updates based on peer editing agreements on clients topics and making corrections to roles and groups chapter. 2020-11-17 20:40:14 +00:00			`For most purposes, {project_name} recommends using OIDC.`
oidc/saml 2016-05-19 00:36:13 +00:00
			`SAML tends to be a bit more verbose than OIDC.`

Update topics/sso-protocols/saml-vs-oidc.adoc 2016-06-10 04:38:24 +00:00			`Beyond verbosity of exchanged data, if you compare the specifications you'll find that OIDC was designed to work with the web while SAML was retrofitted to work on top of the web. For example, OIDC is also more suited for HTML5/JavaScript applications because it is`
			`easier to implement on the client side than SAML. As tokens are in the JSON format,`
			`they are easier to consume by JavaScript. You will also find several nice features that`
Update http://openid.net to https://openid.net 2018-09-05 22:10:36 +00:00			`make implementing security in your web applications easier. For example, check out the link:https://openid.net/specs/openid-connect-session-1_0.html#ChangeNotification[iframe trick] that the specification uses to easily determine if a user is still logged in or not.`
oidc/saml 2016-05-19 00:36:13 +00:00
Update topics/sso-protocols/saml-vs-oidc.adoc 2016-06-10 04:38:24 +00:00			`SAML has its uses though. As you see the OIDC specifications evolve you see they implement more and more features that SAML has had for years. What we often see is that people pick SAML over OIDC because of the perception that it is more mature and also because they already have existing applications that are secured with it.`