Is OAuth used for authentication?

OAuth 2.0 is a framework for authorization, which is the granting of access to resources. It was not designed to confirm identity. When identity is required, OpenID Connect, which is built on top of OAuth 2.0, should be used.

What is the difference between OAuth and OpenID Connect?

OAuth 2.0 grants an application access to resources on behalf of a user through an access token. OpenID Connect adds an identity layer that issues an ID token stating who the user is. OAuth handles authorization, and OpenID Connect adds authentication.

What is SAML used for?

SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. It is widely used for single sign-on in enterprise environments, where an existing corporate directory provides identities.

Which standards does Amazon Cognito support?

Amazon Cognito supports OAuth 2.0, OpenID Connect, and SAML. This allows an application to use modern token-based sign-in and also to federate with corporate providers that use SAML.

Which standard should be chosen for a modern web or mobile application?

OpenID Connect, together with OAuth 2.0, is generally chosen for modern web and mobile applications, because it uses compact tokens and is well suited to programming interfaces. SAML is chosen mainly when integration with an existing SAML provider is required.

OAuth vs OpenID Connect vs SAML

Introduction

OAuth 2.0, OpenID Connect, and SAML are three standards that are often confused because their purposes overlap. OAuth 2.0 is a framework for authorization. OpenID Connect is an identity layer built on OAuth 2.0. SAML, which stands for Security Assertion Markup Language, is an older standard for single sign-on. This guide compares the three and explains when each should be used.

What is being compared?

OAuth 2.0 grants an application access to a resource on behalf of a user, without the user sharing a password with the application. This is authorization, the granting of access. OpenID Connect adds authentication, the confirmation of who the user is, by issuing an identity token in addition to the access token of OAuth. SAML performs both authentication and the exchange of user information, and it is most often used for single sign-on, which allows one sign-in to grant access to several applications.

Why the distinction matters

Because the three standards overlap, one is frequently used for a purpose for which it was not designed. Using OAuth 2.0 on its own to prove identity, for example, has led to security weaknesses. Understanding which standard performs authorization, which performs authentication, and which is intended for enterprise single sign-on allows the correct choice to be made.

How each works

In OAuth 2.0, a user grants an application permission, and the application receives an access token that it presents to a resource in order to act on the user's behalf. In OpenID Connect, the same flow is used, and an additional ID token, in the form of a JSON Web Token, is issued to state who the user is. In SAML, an identity provider authenticates the user and sends a signed XML document, called an assertion, to the service provider that the user is trying to access. An assertion is a statement of the user's identity and attributes.

Comparison diagram

OAuth 2.0 OpenID Connect SAML Primary purpose authorization authentication single sign-on (built on OAuth) and identity Token or format access token access + ID token signed XML (JSON Web Token) assertion Typical use delegated access modern web and enterprise to resources mobile sign-in federation Age modern modern older

Where each is strongest

OAuth 2.0 is strongest for granting an application limited access to a resource without sharing a password.
OpenID Connect is strongest for modern sign-in, because it uses compact tokens that suit web and mobile applications.
SAML is strongest for integrating with existing corporate identity providers that already use it.

Limitations of each

OAuth 2.0 does not confirm identity on its own and should not be used for authentication alone.
OpenID Connect requires support for its token model, which very old systems may lack.
SAML uses verbose XML and is less convenient for mobile applications and programming interfaces.

When to choose each

OAuth 2.0 should be chosen to allow an application to access a resource on behalf of a user.
OpenID Connect should be chosen for the sign-in of a modern web or mobile application.
SAML should be chosen when integration with an existing SAML identity provider is required.

Best practices

OpenID Connect should be used when identity must be confirmed, rather than OAuth 2.0 on its own.
Tokens and assertions should always be validated before access is granted.
All exchanges should take place over an encrypted connection.
A managed service such as Amazon Cognito should be used so that the standards are implemented correctly.

Common mistakes

OAuth 2.0 is used on its own to prove identity, which it was not designed to do.
SAML is forced onto a modern mobile application, where its XML format is inconvenient.
Tokens or assertions are accepted without validation.
The three standards are treated as interchangeable rather than as suited to different purposes.

Amazon Cognito supports OAuth 2.0, OpenID Connect, and SAML.
Amazon API Gateway validates the tokens that these standards produce.
AWS Identity and Access Management governs the permissions of the services involved.

Frequently Asked Questions

Is OAuth used for authentication?: OAuth 2.0 is a framework for authorization, the granting of access to resources. It was not designed to confirm identity. When identity is required, OpenID Connect should be used.
What is the difference between OAuth and OpenID Connect?: OAuth 2.0 grants access to resources through an access token. OpenID Connect adds an identity layer that issues an ID token stating who the user is. OAuth handles authorization, and OpenID Connect adds authentication.
What is SAML used for?: SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. It is widely used for single sign-on in enterprise environments.
Which standards does Amazon Cognito support?: Cognito supports OAuth 2.0, OpenID Connect, and SAML, which allows modern token-based sign-in and federation with corporate providers that use SAML.
Which standard should be chosen for a modern web or mobile application?: OpenID Connect, together with OAuth 2.0, is generally chosen, because it uses compact tokens well suited to programming interfaces. SAML is chosen mainly when integration with an existing SAML provider is required.

Go deeper · Book as a Service™

AWS Cognito

This article is the summary. The book is the full, continuously updated reference: OAuth, OpenID Connect, SAML federation, tokens, and real-world identity integration.

View the book