Security assertion markup language (SAML) is an authentication process. Head to work in the morning and log into your computer, and you've likely used SAML.

Open authorization (OAuth) is an authorization process. Use it to jump from one service to another without tapping in a new username and password. If you're logged into Google and used those credentials for Hootsuite, you've used OAuth.

Both applications can be used for web single sign on (SSO), but SAML tends to be specific to a user, while OAuth tends to be specific to an application. The two are not interchangeable, so instead of an outright comparison, we’ll discuss how they work together.

How Does SAML Work?

SAML is an open standard that verifies identity and offers authentication. In a typical office environment, an employee must log on to gain access to any part of the company's inner functions.

With SAML authentication complete, the user may have access to an entire suite of tools, including a corporate intranet, Microsoft Office, and a browser. SAML allows the user to tap into all of these resources under one digital signature.

Or in companies with tighter security, SAML only allows the user to open a door or unlock a computer screen. Authorization is required before the user can do anything else, including accessing files.

Network administrators can use SAML to manage users from a central location. One password unlocks all the services a person needs, and it protects the company's security too.

A typical SAML workflow looks like this:

• Request: A user taps on a "Log in" button.
• Validation: The SAML and the identity provider connect for authentication.
• Login: The user sees a screen waiting for username and password data.
• Token creation: If the user enters the right information, a SAML token moves to the service provider, which allows the user to log into the server.

This workflow allows a service provider, a browser, and an identity provider to trade information seamlessly. The user may not even notice the delay, as this process is typically handled in seconds.

How Does OAuth Work?

While “auth” can mean Authentication or Authorisation, for the OAuth protocol, we mean specifically authorisation. This protocol is used to pass authorisation from one service to another, all while protecting someone's username and password.

Think of OAuth as a critical timesaver in an environment where the average employee switches job-critical applications a whopping 1,100 times per day. Sometimes, employees want a way to jump from one app to another without logging in again. OAuth makes that possible.

Consider an employee with an active Google account. That person could use the same credentials to tap into data found on:

• Hootsuite
• SurveyMonkey
• HotJar
• Microsoft 365
• Salesforce
• Marketo
• Box

The employee needs all of these web-based programs to do the job right. But that same person may shudder at creating (and remembering) five different sets of usernames and passwords.

Duplicating the usernames and passwords is a security gamble. If one site fails, the user's critical data is exposed and vulnerable on all the platforms. But logging into another site with validation provided by the first is very different.

Some consumers worry about data mining, and they suggest using a tool like this gives companies like Facebook too much power. Each time a user selects a Facebook login for other apps and sites, Facebook gains more customer insight. And if Facebook's data is compromised, that person's additional logins could fail too.

But most employees would be thankful for the ability to save time during busy, stressful periods.

An OAuth workflow looks like this:

• Request: A user clicks on a "Log in" button on a web page.
• Choice: The client chooses the third-party authorisation credentials to use.
• Log in: The authorisation server creates an access token, and that’s sent to the resource server.
• Connection: After verifying the token, the resource server grants access.

Throughout this process, the two servers are passing information back and forth. Typically, OAuth uses JWT for tokens, but it can also use JavaScript Object Notation instead.

No matter how they are created, tokens are always encoded, usually signed, but rarely encrypted as they pass from one server to another.

OAuth vs. SAML: Similarities and Differences

Both OAuth and SAML are protocols to encourage and standardise interoperability.

People use these tools to avoid an ever-expanding list of usernames and passwords that block them from accessing critical resources. For app owners, OAuth and SAML allow for easy onboarding and the ability to delegate user management. For admins, these tools mean fast integration and centralised authentication and authorisation.

But the two tools handle very different functions involving:

• Authentication. This process involves a user's identity. SAML is a bit like a house key. It grants you access to the facility.
• Authorisation. This process involves a user's privileges. OAuth is a bit like the rules of the house that dictate what the person can and can't do once inside.