OIDC vs SAML: Which Protocol to Choose
The difference between OIDC and SAML, the two standard protocols for SSO, and how to choose between them for your apps.
OIDC and SAML are both standard authentication protocols that implement SSO. They are the same in that they are conventions for an IdP and an app to exchange authentication results safely, but their underlying technology and usage differ. SAML is XML-based, and OIDC is an authentication layer built on top of OAuth 2.0.
What SAML is
SAML (Security Assertion Markup Language) is a standard for exchanging authentication information in XML format. The SP verifies a signed assertion issued by the IdP to process login. It has long been used in enterprise apps and on-premises systems, and tends to have wide support in traditional B2B SaaS.
What OIDC is
OIDC (OpenID Connect) is a standard that adds an authentication layer on top of OAuth 2.0. It passes the authentication result in the form of an ID token, and uses JSON and REST, so it fits mobile apps and API-friendly environments well. Relatively recent apps often support it first.
Which to choose
In practice, rather than picking one of the two in advance, you end up following what the app you want to integrate supports. Some apps support only SAML, others only OIDC. So for a company connecting several apps, it is safer for the IdP to provide both protocols.
For a newly adopted app, check OIDC first; for an existing enterprise app, look at whether it supports SAML. In short, the two protocols are less rivals than complementary standards that cover different app ecosystems. Whichever you use, the core principle is the same: the app does not handle the password directly and only verifies the authentication result of a trusted IdP.
The adoption steps including protocol choice continue in the SSO Adoption Guide for Small to Large Businesses. AxiPass provides both OIDC and SAML 2.0 as an IdP, so you can start for free and integrate in the way that fits your apps.