Choose OpenID Connect (OIDC) for any new web, mobile, SPA, or API-based application, and add SAML 2.0 only when an enterprise customer, partner, or legacy identity provider requires it. Microsoft tells ISVs to default to OIDC for new SaaS development when unsure, and Login.gov, the US federal login service, recommends OIDC wherever possible while still supporting SAML. In our lab test, a signed SAML response was 7.0x larger than an equivalent OIDC ID token.
Verdict at a glance
| Question | SAML 2.0 | OpenID Connect |
| Implementation difficulty | High: XML signatures, canonicalization, certificate exchange | Low to medium with a maintained library |
| Values to exchange per integration (our test) | 8, across two XML metadata files | 4 (plus a secret for server-side apps) |
| Token size, same user (our test) | 6,152 bytes | 875 bytes |
| 2025 to 2026 security record | Multiple critical signature-wrapping bypasses in SAML libraries | Main risks are misconfiguration |
| Best fit | Enterprise workforce SSO, legacy IdPs, academic federation | New SaaS, mobile, SPAs, APIs, consumer login, AI agents |
Is “OpenID” the Same as OpenID Connect?
Yes, in current usage. When people compare SAML vs OpenID, they mean OpenID Connect Core 1.0, a final specification dated February 25, 2014, which defines a simple identity layer on top of OAuth 2.0.
| Term | What it means in 2026 |
| OpenID 2.0 | Legacy protocol; the OpenID Foundation publishes a migration spec for moving OpenID 2.0 identifiers to OIDC |
| OpenID Connect (OIDC) | Current standard for login, built on OAuth 2.0 |
| SAML 2.0 | Separate XML-based OASIS standard, ratified March 2005 |
For saml vs openid vs oidc searches: “OpenID” and “OIDC” refer to the same modern protocol. Statistics describing OpenID 2.0 do not describe OIDC.
For More Information: What Is SAML? How SAML Works, How SAML Is Used, and Where It Breaks
SAML vs OpenID Connect: How Do They Compare?
Both deliver federated single sign-on (SSO). They differ in data format, architecture, and platform reach. SAML background: OASIS SAML V2.0 Technical Overview.
| Attribute | SAML 2.0 | OpenID Connect |
| Data format | XML assertions | JSON Web Tokens (JWT) |
| Architecture | Standalone protocol | Authentication layer on OAuth 2.0 |
| Developer experience | XML parsing, metadata files, certificates | REST, JSON, auto-discovery |
| Platform support | Browser-based web apps | Web, SPA, native mobile, CLI, APIs |
| Trust setup | XML metadata exchange | /.well-known/openid-configuration discovery |
| Key rotation | Manual certificate updates on both sides | Published through a JWKS endpoint |
| API authorization | Out of scope | Yes, through OAuth 2.0 access tokens |
| MFA request / proof | RequestedAuthnContext / AuthnContextClassRef | acr_values / acr and amr claims |
| Multilateral federation | Mature (InCommon, eduGAIN) | Final specification since 2026 |
Microsoft’s comparison rates SAML enterprise adoption as widely established and OIDC as growing rapidly, SAML development complexity as higher because XML processing is required, and SAML mobile and SPA support as challenging versus native for OIDC.
How Do SAML and OIDC Work?
SAML carries identity through the browser in one signed XML document. OIDC sends only a short-lived code through the browser and delivers tokens over a direct back-channel call.
For More Information: What Is SAML Authentication? How It Works, With Examples
How does the SAML flow work? (SP-initiated)
- The user opens the app (Service Provider, SP).
- The SP redirects the browser to the Identity Provider (IdP) with an AuthnRequest.
- The IdP authenticates the user and signs an XML assertion.
- The browser POSTs the SAMLResponse to the SP’s Assertion Consumer Service (ACS) URL.
- The SP validates the signature, then separately validates audience, recipient, and time conditions.
How does the OIDC flow work? (Authorization Code + PKCE)
- The app (Relying Party, RP) redirects the user with scope=openid and a PKCE code_challenge.
- The user authenticates; the provider redirects back with a one-time code.
- The app exchanges the code plus PKCE verifier for an ID token and access token.
- The app validates the ID token as specified in OIDC Core Section 3.1.3.7.
How do SAML and OIDC terms map to each other?
| SAML | OIDC |
| Identity Provider (IdP) | OpenID Provider (OP) |
| Service Provider (SP) | Relying Party (RP) |
| Assertion | ID token |
| NotBefore / NotOnOrAfter | nbf / exp |
| InResponseTo | nonce / state |
| urn:oid:0.9.2342.19200300.100.1.3 | |
| urn:oid:2.5.4.42 / urn:oid:2.5.4.4 | given_name / family_name |
What Did Our SAML vs OIDC Lab Test Show?
We generated both token types for the same user in an identical environment and measured size, validation speed, rejection behavior, and configuration effort.
- Methodology (September 25, 2026): Python 3.12.3, signxml 5.1.0 (SAML), PyJWT 2.7.0 (OIDC), cryptography 46.0.6, lxml 6.0.2, one Intel Xeon 2.1 GHz core. RSA-2048 keys, SHA-256 signatures. The SAML assertion was signed with the X.509 certificate embedded, which is how most IdPs send it. Claims were identical: subject, email, first name, last name, and 3, 20, or 100 groups. This is a protocol-level test; it does not measure IdP console setup time.
Test script and raw results: SAML vs OIDC benchmark on GitHub.
Test 1: How much larger is a SAML response than an ID token?
| Groups per user | SAML Response (Base64, as POSTed) | OIDC ID token | SAML / OIDC |
| 3 | 6,152 bytes | 875 bytes | 7.0x |
| 20 | 7,308 bytes | 1,125 bytes | 6.5x |
| 100 | 12,748 bytes | 2,298 bytes | 5.5x |
Token size for identical claims. SAML’s fixed overhead comes mostly from the XML signature block and embedded certificate.
Why size matters in production:
- Microsoft Entra ID caps groups in a token at 150 for SAML and 200 for JWTs, and states the lower SAML limit exists because SAML tokens are bigger.
- Past the cap, Entra omits the groups claim entirely, so your app must fetch membership from Microsoft Graph.
- A 2,298-byte ID token with 100 groups still fits under the common 4,096-byte per-cookie browser limit.
Test 2: Which validates faster?
| Operation | Median | 95th percentile | Runs |
| SAML assertion (XML signature + digest only) | 0.73 ms | 0.86 ms | 1,000 |
| OIDC ID token (signature + iss, aud, exp) | 0.065 ms | 0.091 ms | 5,000 |
JWT validation was about 11x faster, even though it included claim checks that the SAML measurement did not.
Takeaway: Both are sub-millisecond, so speed should not decide the protocol. The gap reflects XML canonicalization work, the same code path where SAML signature-wrapping bugs occur.
Test 3: Do the libraries reject bad input?
| Attack input | SAML (signxml 5.1.0) | OIDC (PyJWT 2.7.0) |
| Attribute or claim modified after signing | Rejected (InvalidDigest) | Rejected (InvalidSignatureError) |
| Document with DOCTYPE / entity declaration | Rejected (InvalidInput) | Not applicable |
| Unsigned token (alg: none) | Not applicable | Rejected when algorithms are pinned |
| Wrong audience | Signature still valid; audience not checked by the library | Rejected (InvalidAudienceError) when audience is passed |
- Key finding: A SAML signature library proves the XML was signed, not that it was meant for your app. Your code must separately validate audience, recipient, destination, time window, and InResponseTo. PyJWT performs audience and issuer checks inside the same decode call.
For More Information: What Is a SAML Assertion? Structure, Example, and Validation (2026)
Test 4: How much configuration does each need?
| Item | SAML | OIDC |
| Metadata artifacts | SP metadata (1,650 bytes) + IdP metadata (1,618 bytes) | Discovery document, fetched automatically |
| Values each side enters | 8: SP entity ID, ACS URL, SP cert, IdP entity ID, IdP SSO URL, IdP signing cert, NameID format, attribute mapping | 4: issuer URL, client ID, redirect URI, scopes (plus client secret for confidential clients) |
| Client configuration size | Two XML files | 152 bytes of JSON |
SAML vs OpenID: Which Is Better for Your Scenario?
Three questions settle most SAML vs OIDC decisions.
| Scenario | Use | Why |
| New B2B or B2C SaaS | OIDC | Discovery, smaller tokens, native mobile and SPA support |
| Enterprise RFP requires SAML | Both | OIDC internally, SAML per customer at the edge |
| Workforce apps on Entra ID or Okta | Either, OIDC preferred | Both supported; OIDC has lower maintenance |
| Native mobile app | OIDC | Code flow with PKCE |
| SPA (React, Vue, Angular) | OIDC | Code flow with PKCE or a backend-for-frontend |
| Social login (Google, Apple, GitHub) | OIDC | These providers issue OIDC tokens |
| Legacy app that only speaks SAML | SAML | Replacement cost exceeds benefit |
| University or research federation | SAML now, OIDC Federation next | InCommon and eduGAIN run on SAML metadata |
| Calling Microsoft 365 or other APIs as the user | OIDC + OAuth 2.0 | SAML issues no access tokens |
| AI agents and tool access | OAuth 2.0 / OIDC | Agent authorization relies on OAuth scopes and tokens |
Real-world API limit: when a WordPress site uses SAML sign-in with Microsoft Entra ID, the WPO365 plugin cannot obtain delegated access to Microsoft 365 services such as Graph, SharePoint, or Power BI.
When should you choose SAML?
- A customer, partner, or procurement rule explicitly names SAML.
- The upstream IdP does not support OIDC.
- A stable SAML integration exists and there are no mobile or API needs.
- You must join a SAML federation such as InCommon or eduGAIN.
When should you choose OpenID Connect?
- You are building a new app, especially with mobile, SPA, or API components.
- You need social login or consumer sign-up.
- You want automatic key rotation and self-service tenant onboarding.
- Users belong to many groups, or you need API access in the same flow.
When should you use both?
Microsoft recommends supporting both protocols when your customers span modern and legacy identity environments. The standard pattern is OIDC inside the app, with an identity broker accepting SAML from enterprise IdPs.
Read More: SAML vs LDAP: What Is the Difference, and Which Should You Use in 2026?
OIDC vs SAML: Which Is More Secure?
Neither is inherently more secure. SAML’s recent critical failures sit in service-provider XML parsing and signature verification; OIDC’s common failures sit in configuration.
What does the 2025 to 2026 SAML vulnerability record show?
| CVE | Library | Issue | Severity / fix |
| CVE-2025-25291 | ruby-saml | Parser differential enables signature wrapping | CVSS 9.3 Critical; fixed in 1.12.4 and 1.18.0 |
| CVE-2025-66567 | ruby-saml | Incomplete fix for CVE-2025-25292 | Upgrade to 1.18.0 or later |
| CVE-2025-66568 | ruby-saml via libxml2 | Canonicalization failure enables replay of a signed empty string | Upgrade to 1.18.0 or later |
| CVE-2024-45409 | ruby-saml | Signature verification bypass | CVSS 10 |
- Root cause: Two XML parsers (ReXML and Nokogiri) can produce different document structures from the same input, so the signature check and the login logic read different elements (GitHub Advisory).
- Scope: PortSwigger’s December 2025 research described new signature-wrapping classes that fully bypass authentication in widely used open-source SAML libraries.
- Responsibility: Okta responded that changing its signing behavior would violate the SAML and WS-Fed standards, and that service providers should patch. The fix is your SP library, not the IdP.
What are the main OIDC risks?
| Risk | Mitigation |
| Authorization code interception | PKCE (RFC 7636) on every client |
| Open or wildcard redirect URIs | Exact-match redirect URI registration |
| Token theft from browser storage | Backend-for-frontend pattern or short-lived tokens |
| Weak JWT validation | Pin algorithms; verify iss, aud, exp, nonce |
| Implicit flow | Authorization Code flow only |
RFC 9700, the IETF’s OAuth 2.0 security Best Current Practice published January 2025, deprecates modes of operation now considered less secure or insecure.
What should a secure implementation checklist include?
- SAML: Use a maintained library pinned to patched versions, and read claims only from the element the verifier returns.
- SAML: Reject DOCTYPE; validate audience, recipient, destination, time window, and InResponseTo; avoid IdP-initiated SSO.
- OIDC: Use a certified library, enforce PKCE, and pin signing algorithms.
- Both: Enforce phishing-resistant MFA at the IdP and require proof of it through AuthnContextClassRef (SAML) or acr/amr (OIDC).
Does Government or Compliance Work Require SAML?
Not by default. Government SAML use reflects existing infrastructure, not a universal mandate.
- Login.gov is a FedRAMP Moderate-approved MFA and identity-proofing platform that connects applications through either OIDC or SAML.
- Its SAML guide strongly recommends OIDC for its API-centric design and native mobile support (Login.gov SAML guide).
- Compatible platforms include Okta, Ping Identity, Microsoft ADFS, Keycloak, Shibboleth, and Amazon Cognito.
Action: Read the actual contract, RFP, or federation agreement. Implement SAML where it is named; where the requirement is “federated login with MFA,” OIDC usually qualifies.
Can OpenID Connect Handle Federation Like SAML?
Yes, as of 2026. Multilateral federation was SAML’s last structural advantage.
- OpenID Federation 1.0 was approved as a Final Specification with 85 votes in favor and 0 objections, announced February 17, 2026.
- OpenID Federation 1.1 and OpenID Federation for OpenID Connect 1.1 became Final Specifications on May 6, 2026.
- An interoperability event at TIIME 2026 tested nine implementations.
Implication: OIDC now has a standardized trust-chain model. InCommon and eduGAIN still run on SAML, so plan for SAML in research and education for now.
Read more information about: SAML vs SSO: Is SAML the Same as Single Sign-On?
SAML vs OAuth2: What Is the Difference?
- OAuth 2.0 (RFC 6749) issues access tokens for calling APIs; it does not identify the user to the app.
- SAML identifies the user and carries attributes; it issues no API tokens.
Bridge: RFC 7522 (May 2015) defines how to exchange a SAML 2.0 bearer assertion for an OAuth 2.0 access token, so a SAML-authenticated enterprise user can call OAuth-protected APIs without a second login.
OIDC vs SAML vs OAuth vs Kerberos: How Do All Four Compare?
| Attribute | SAML 2.0 | OIDC | OAuth 2.0 | Kerberos v5 |
| Purpose | Authentication + attributes | Authentication | Authorization | Network authentication |
| Credential | XML assertion | JWT ID token | Access token | Tickets (TGT, service ticket) |
| Transport | Browser redirect/POST | HTTPS redirect + REST | HTTPS | Direct to Key Distribution Center |
| Typical scope | Cross-domain web SSO | Web, mobile, API login | API access | Active Directory domains, intranet |
| Open internet use | Yes | Yes | Yes | Generally no; needs domain controller reachability |
| Standards body | OASIS | OpenID Foundation | IETF | IETF (RFC 4120) |
For saml vs oauth vs openid vs kerberos queries: Kerberos signs users into Windows domains and on-premises services; SAML and OIDC extend that identity to web and cloud apps; OAuth grants API access.
Read More: SAML vs OAuth: What Is the Difference and Which Should You Use in 2026?
What Does Each Protocol Cost to Run?
| Cost driver | SAML | OIDC |
| Customer onboarding | Exchange metadata, certificates, and 8 values per tenant | Paste an issuer URL; discovery fills the rest |
| Key rotation | Coordinated certificate swaps on both sides | Automatic through JWKS |
| Group-heavy users | 150-group cap in Entra, then Graph lookups | 200-group cap in Entra, then Graph lookups |
| Typical production failure | Expired certificate, clock skew, broken certificate chain | Redirect URI mismatch, token storage mistakes |
- Login.gov rotates its SAML signing certificate once a year, so every SAML relying party must update in sync.
- A missing intermediate certificate can break SSO for mobile clients while desktop browsers keep working from cached intermediates.
How Do You Migrate from SAML to OIDC?
- Inventory every SAML integration, its IdP, certificate expiry date, and consumed attributes.
- Map attributes to claims using the vocabulary table above.
- Build all new apps on OIDC only.
- Broker legacy IdPs with an identity broker so apps receive OIDC tokens.
- Migrate one tenant at a time and run both paths until login success rates match.
- Retire SAML endpoints only after no contract or partner requires them.
Read More: SAML vs OIDC: Which SSO Protocol Should You Use in 2026?
Frequently Asked Questions ( FAQs)
Is OIDC replacing SAML?
For new development, largely yes. SAML remains in existing enterprise integrations and research federations, which will run for years.
Is SAML outdated in 2026?
No. It is mature and widely deployed but now a requirement-driven choice rather than a default. Keep SAML libraries patched given the 2025 CVE record.
Does Microsoft Entra ID use SAML or OIDC?
Both. Entra ID fully supports each, and Microsoft recommends OIDC for new SaaS. Protocol references: Entra SAML protocol and Entra OIDC protocol.
Is SCIM the same as SAML?
No. SAML and OIDC handle sign-in. SCIM handles provisioning: creating, updating, and deactivating user accounts. Enterprise SSO requirements usually include both.
Can SAML and OIDC be used together?
Yes. Run OIDC inside the application and accept SAML at the edge through an identity broker.
Which is better for mobile apps, SAML or OpenID?
OpenID Connect. It supports native apps through the Authorization Code flow with PKCE, while SAML relies on browser POST flows that native apps handle poorly.
