SAML 2.0 vs OAuth 2.0 & OpenID Connect
Understanding when to use SAML 2.0 enterprise federated SSO versus OpenID Connect API authorization.
| Dimension | SAML 2.0 (This App) | OpenID Connect & OAuth 2.0 (HR App) |
|---|---|---|
| Primary Purpose | Enterprise Web Single Sign-On (SSO) | User Authentication (OIDC) & Delegated API Access (OAuth) |
| Payload Format | XML (<saml:Assertion>) | JSON Web Tokens (JWT) |
| Payload Weight | Heavy (often 5 KB – 15 KB XML) | Lightweight compact strings (1 KB – 2 KB) |
| Device / Client Fit | Traditional Web Browsers (Cookie/Redirect) | Mobile Apps, SPAs (React/Angular), Microservices, APIs |
| Key Exchange | X.509 Certificate upload (.cer / .pem) | JSON Web Key Sets (JWKS discovery URI) |
| Entra ID Object | Enterprise Applications (Gallery/Non-Gallery) | App Registrations (Client ID + Secret/PKCE) |
| Transport Binding | HTTP-Redirect & HTTP-POST | HTTP GET/POST redirect query & Authorization: Bearer |