Search code examples
samlonelogin

OpenID connect VS SAML flows

I am currently going through OneLogin's documentation. There is one point that remains unclear to me.

I think I understand the main differences between SAML and OIDC.

However on the SAML description it seems that there is no authentication required from the end user.

Compared to the OIDC description, where a code is required from the end user.

This point only would make me lean toward SAML as it is "frictionless".

My questions are -knowing that I want to integrate with OneLogin-:

  • Is SAML "frictionless"? Can it be?
  • Is OIDC "frictionless"? Can it be?
  • If so, is it a specific OneLogin feature? (It seems that all the documentation that I found online mention authentication with the IdP)

Thank you for your help!

Solution

  • The article states:

    "The user either has an existing active browser session with the identity provider or establishes one by logging into the identity provider."

    So the user has to authenticate if no existing browser session.

    The article is around SSO i.e. if you have already logged into an IDP with SAML and you access another application on that same IDP, you won't have to login again.

    OIDC has the same approach.

    OIDC can be "frictionless" if you use the Resource Owner Password flow where you pass the user name and password under the hood. The user does not have to authenticate.

    But it's deprecated in OAuth 2.1 as it's not secure.