| WS-FED | SAML | OAuth | |
| Usage | Authentication | Authentication | Authorization |
| Scenario | SSO | SSO | Access to resources |
| Naming conventions | Client Identity Provider (IdP) Resource | Client Identity Provider (IdP) Service Provider (SP) | Client Authorization server Resource server |
| Procedure | Authentication is done on the IdP side and a token is given to access the resource. | Authentication is done on the IdP side and a token is given to access the resource. | Authorization grant is given by resource for getting the Access token from Authorization Server to access the resource |
| Request to IdP/ Authorization server | Query parameters in a Request Security Token (RST) | SAML request | User is Authorization Key |
| Response from IdP/ Authorization server | Request Security Token Response (RSTR). Inside that RSTR is a SAML assertion. | Inside that SAML response is a SAML assertion. | Access key |
| Non-repudiation | Responses are signed | Responses may or may not be signed | Responses are signed |
| Sign-in Protocol | 1. Wa: indicates need for login 2. Wtrealm: Tells IdP which SP is being requested access. 3. Wctx: Session data 4. Wct: exact time of accessing SP | 1. SAMLRequest: Base64 encoded XML 2. RelayState:Session Data 3. SigAlg: Signature algorithm 4. Signature: digital signature of the request | 1. Response_type : specifies the action needed from IdP 2. client _id: Identification of the SP 3. Resource: URL/URI of SP 4. Redirect_uri:browser or SP |
| Authentication Protocol | Forms-based | Kerberos | Form-based, OTC(one-time code) for access token for requesting necessary user data |
| Token | SAML 1.1 token is sent to the browser which is sent via POST request to SP | SAML 2.0 token | JSON Web Token (JWT) |
| Transport | HTTP, POST or HTTP REDIRECT binding , SOAP or JMS | HTTP, POST or HTTP REDIRECT binding , SOAP or JMS | HTTP only |
| More Information | https://securdi.com/iam/working-of-ws-fed/ | https://securdi.com/iam/how-saml-works/ | https://securdi.com/iam/working-of-oauth/ |
Through our seasoned professionals, we can also help you evaluate, develop and operate these protocols for between your Access Management system and your enterprise applications thus providing a seamless user experience.
– Authored by Gayatri Priyadarshini