← Back to the reading view
Slides · 5 slides
Federated identity: OAuth2, OIDC, and SAML, untangled
The same use case told visually, ready to present. Speaker notes carry the full explanation.
Identity & Access
Federated identity, untangled
"Just use OAuth" hides three standards solving three different problems
Federated identity: OAuth2, OIDC, and SAML, untangled · Classical Crypto Today1 / 5
OAuth2
Authorization Code flow with PKCE
A stolen code is useless without the verifier only the app holds
Federated identity: OAuth2, OIDC, and SAML, untangled · Classical Crypto Today2 / 5
OIDC
The ID token: a signed proof of identity
Federated identity: OAuth2, OIDC, and SAML, untangled · Classical Crypto Today3 / 5
SAML
OIDC versus SAML
An HR system that only parses XML assertions decides for you: SAML
Federated identity: OAuth2, OIDC, and SAML, untangled · Classical Crypto Today4 / 5
Passkeys
Where passkeys fit: a different layer
FIDO proves who you are to the IdP; OIDC and SAML carry that to everyone else
Federated identity: OAuth2, OIDC, and SAML, untangled · Classical Crypto Today5 / 5
1 / 5
Keys: ← → move, F full screen, G all slides, N notes