SAML vs OAuth: what is the difference and which do you need?

SAML and OAuth solve different problems. SAML passes signed statements about who a user is so they can sign in to another organization's app. OAuth 2.0 lets an application obtain limited access to a service. OpenID Connect sits on top of OAuth to provide sign in. Pick by the question you are asking.

What does each standard say it is for?

The OASIS technical overview says the Security Assertion Markup Language defines a framework for exchanging security information between online business partners. Its core idea is the assertion, a statement from an identity provider about a user that a service provider can trust.

RFC 6749 says the OAuth 2.0 authorization framework enables a third party application to obtain limited access to an HTTP service, either on behalf of a resource owner by arranging an approval interaction, or on its own behalf.

OpenID Connect Core 1.0 describes itself as a simple identity layer on top of OAuth 2.0. It lets clients verify the identity of the end user based on authentication performed by an authorization server, and obtain basic profile information.

Note the verbs. SAML exchanges identity information. OAuth grants access. OpenID Connect adds identity to OAuth.

Which question does each answer?

Constructed example with three situations at one company.

• An employee opens the HR software from the company portal and is signed in without a new password. The HR vendor trusts the company's identity provider, which sends a signed assertion. That is SAML single sign on.
• A scheduling app asks to read the employee's calendar. The employee approves a screen listing the access, and the app gets a token that allows reading the calendar and nothing else. That is OAuth.
• A new mobile app offers "sign in with your company account". It needs to know who the user is, so it uses OpenID Connect, which returns an ID token on top of an OAuth flow.

Treating OAuth alone as proof of identity is a classic mistake. An access token says the holder may call an API. It does not by itself say who is at the keyboard. OpenID Connect exists to fill that gap.

How do they differ in practice?

SAML messages are XML and the browser carries them between parties, with profiles for service provider initiated and identity provider initiated sign in. The overview notes that when a response containing an assertion goes through the user's browser using the HTTP POST binding, the response must be digitally signed with XML Signature to ensure integrity. That signature check is where many implementation bugs live.

OAuth and OpenID Connect are built around HTTP and tokens, which suits mobile apps and APIs. SAML was designed for browser based federation between organizations and is common in enterprise single sign on.

How do you choose?

1. Enterprise customers expect to sign in to your SaaS with their own identity provider: support SAML, and often OpenID Connect too.
2. Your app needs limited access to a user's data in another service: use OAuth, and request the narrowest scopes.
3. You need sign in for a modern web or mobile app: use OpenID Connect.
4. You are building an API for your own clients: use OAuth flows suited to each client type.

Many products support more than one, because customers differ.

How to check or apply this

1. Write down which question each integration answers: who is this, or what may this app do.
2. Never treat a plain access token as proof of user identity.
3. Validate everything: for SAML, signatures, audience and validity window. For OAuth and OIDC, issuer, audience, expiry and the redirect address.
4. Request minimum scopes and review them when features change.
5. Keep the library or product you use for these protocols patched, since flaws in parsers and signature checks are a known source of vulnerabilities.
6. Test sign out and account removal. Deprovisioning is where federation often breaks.

Quick check

Sources

• OASIS, Security Assertion Markup Language (SAML) V2.0 Technical Overview
• RFC 6749, The OAuth 2.0 Authorization Framework
• OpenID Connect Core 1.0

Last reviewed: 18 October 2026.