Web Security & OWASP (50 Qs)•Part 3: Authentication, Authorization & Cryptographic Standards (26 - 35)
Enterprise Single Sign-On (SSO): SAML 2.0 vs. OpenID Connect (OIDC) federation architectures.
Enterprise Identity Federation
Enterprise organizations use Single Sign-On (SSO) so employees log into work applications using corporate identity providers (Okta, Azure AD, Ping Identity).
ini
SAML 2.0 (XML Based):
[ Service Provider (SP) ] === SAMLRequest ===> [ Identity Provider (IdP: Okta) ]
<=== SAMLResponse == (Signed XML Assertion containing roles)
OIDC (JSON / REST Based):
[ Relying Party (RP) ] === Auth Request ===> [ OpenID Provider (IdP) ]
<=== ID Token ====== (Cryptographically Signed JWT)
Key Comparisons
| Feature | SAML 2.0 | OpenID Connect (OIDC) |
|---|---|---|
| Format | Heavyweight XML with XML-DSig digital signatures. | Lightweight JSON Web Tokens (JWT). |
| Transport | Browser HTTP POST bindings and base64 redirection. | RESTful HTTP calls with standard JSON payloads. |
| Adoption | Legacy enterprise software, government, Fortune 500. | Modern web applications, mobile apps, single page apps. |
| Security Risks | XML Signature Wrapping (XSW) attacks, XXE injection. | Algorithm confusion (alg: none), token leakage in URL. |