Knowledge check

Federated identity: OAuth2, OIDC, and SAML, untangled

10 questions testing what you just read — no login, no tracking, just immediate feedback.

Question 1 of 10

What does OAuth2 fundamentally provide?

Question 2 of 10

What does OIDC add on top of plain OAuth2?

Question 3 of 10

What problem does PKCE solve for a public OAuth2 client (like a mobile app)?

Question 4 of 10

What format does a SAML assertion use, in contrast to an OIDC ID token?

Question 5 of 10

Why does SAML remain common in enterprise SSO despite OIDC being the more modern default?

Question 6 of 10

What do the iss, sub, aud, and exp claims inside an OIDC ID token represent?

Question 7 of 10

What specific problem does FIDO/WebAuthn (passkeys) solve, relative to OIDC and SAML?

Question 8 of 10

A user logs into an identity provider with a passkey, and the IdP then issues an OIDC ID token to a downstream app. What does the downstream app need to know about the passkey login?

Question 9 of 10

Which protocol should an identity provider use to authenticate users into a legacy platform that only understands XML-based, XML-DSig-signed assertions?

Question 10 of 10

What is the Authorization Code flow, in OAuth2 terms?

0 / 10 answered