Single sign-on

SAML 2.0 exchanges signed XML assertions through browser redirects and form posts. It is established in enterprise software and is the older of the two.

OpenID Connect is a thin identity layer over OAuth 2.0, using JSON and JSON Web Tokens. It is the usual choice for new work and for anything involving mobile applications or APIs.

Both delegate authentication to a provider and return a signed statement about the user. The difference is encoding, not concept.

OAuth 2.0 alone is authorisation, not authentication. Using it as a login mechanism without the OpenID Connect layer is a well-documented source of flaws.

SCIM is the companion protocol for provisioning: single sign-on answers who someone is at login, and SCIM keeps the account list itself synchronised.

One credential to protect, which means one place to enforce strong multi-factor authentication properly.

Central deprovisioning: disabling an account removes access to every connected application at once, which is the part manual processes reliably get wrong.

Consistent policy — session length, device requirements, conditional access — applied uniformly rather than per application.

An audit trail of authentications in one place rather than scattered across systems.

Compromise of the identity provider is compromise of everything connected to it. The value of the target rises accordingly.

An outage at the provider is an outage everywhere, which is why break-glass accounts that bypass it exist and why they need their own protection.

Session handling becomes subtle: logging out of one application does not necessarily end the provider session, and a user who believes they have logged out may not have.

Implementation flaws in assertion validation — accepting an unsigned assertion, not checking the audience, not checking expiry — are a recurring class of serious vulnerability in both protocols.

A login page offering a provider button, or redirecting to a provider's domain, indicates that single sign-on is available.

Discovery documents at well-known paths indicate an OpenID Connect provider.

Whether it is enforced, whether local passwords remain usable, and how sessions are handled are internal matters not visible externally.

Availability is a signal about the organisation's identity posture rather than a measure of it.

Where a discovery document is published, its contents state the supported algorithms and endpoints, which is a factual description of the configuration rather than an inference.