Comparison of OAuth, OpenID, SAML, and OIDC (CISSP Focus)

 

Feature	OAuth (Primarily v2.0)	OpenID Connect (OIDC)	SAML
Primary Function	Authorization: Grants limited access to protected resources (e.g., APIs) on behalf of a resource owner, without sharing credentials.	Authentication & Authorization: Provides user identity information and access to resources. Builds on OAuth 2.0.	Authentication & Authorization: Exchanges user authentication and attribute information between security domains.
Focus	Resource access delegation.	User identity and resource access.	Federated identity management and single sign-on (SSO).
Protocol	Primarily HTTP-based.	HTTP-based, leveraging JSON.	Primarily XML-based (SOAP).
Data Format	Access tokens (opaque strings).	ID tokens (JWT - JSON Web Token) containing user claims, and access tokens.	SAML assertions (XML) containing user attributes.
Key Components	Resource Owner, Client, Authorization Server, Resource Server.	Identity Provider (IdP), Relying Party (RP) (Client in OAuth terms).	Identity Provider (IdP), Service Provider (SP).
Security Considerations	- Token management and protection are crucial. <br> - Vulnerable to token theft and replay attacks. <br> - Scope of access should be carefully defined (least privilege). <br> - Implicit grant type (if used) poses security risks.	- ID token validation is essential. <br> - JWT signature verification is critical. <br> - Protect private keys used for signing. <br> - Proper redirect URL validation.	- XML signature wrapping attacks are a concern. <br> - Key management for signing assertions is vital. <br> - Metadata exchange security. <br> - Potential for attribute manipulation.
Use Cases	- Accessing social media APIs. <br> - Granting third-party apps access to user data (e.g., calendar, contacts).	- Single sign-on (SSO) to web applications. <br> - User profile management. <br> - Mobile app authentication.	- Enterprise SSO. <br> - Cross-domain authentication (e.g., between organizations). <br> - Web services security.
Strengths	- Fine-grained control over resource access. <br> - Doesn't require sharing user credentials with third-party applications.	- Standardized way to obtain user identity information. <br> - Widely adopted and supported.	- Robust and mature protocol. <br> - Suitable for complex identity federation scenarios.
Weaknesses	- Doesn't inherently provide user authentication. <br> - Can be complex to implement correctly.	- Adds complexity on top of OAuth.	- Verbose XML format. <br> - Can be more complex to implement than OAuth/OIDC for simpler use cases.
CISSP Relevance	- Understanding authorization mechanisms. <br> - Security implications of token-based access. <br> - Importance of least privilege.	- Authentication and identity management. <br> - Security of JWT and ID tokens. <br> - SSO and its security benefits and risks.	- Federated identity and its challenges. <br> - Importance of XML security. <br> - Understanding trust relationships between organizations.
Example	A user allowing a photo printing service to access their photos on a cloud storage platform without giving the service their cloud storage password.	A user logging into a website using their Google account.	A user accessing a corporate intranet application after authenticating with their company's identity provider.