These four terms get lumped together, but they answer different questions. The fastest way to keep them straight is to ask one thing about each: is it about proving who you are, or about granting access to something?
Start here — the distinction everything else hangs on
Authentication — “who are you?”
Verifies identity and hands the app proof of who the user is. This is what login means. OIDC and SAML do this.
Authorization — “what may you do?”
Grants scoped access to resources or actions, without necessarily revealing who the user is. OAuth 2.0 does this — it is not a login protocol.
Pattern, not a protocol
SSO
One login → many apps. A goal you implement using OIDC or SAML.
Authorization
OAuth 2.0
Delegated access to APIs. Issues access tokens for authorization, not ID tokens for login.
Authentication
OIDC
A thin identity layer built on top of OAuth 2.0. Adds the ID token.
Authentication
SAML 2.0
XML-based identity federation for enterprise SSO. The older standard for the same job.
SSOSingle Sign-OnConcept / Pattern
Typical flow
- User tries to reach App A and isn’t signed in.
- App A redirects to a shared Identity Provider (IdP).
- User authenticates once; the IdP creates a session.
- User later opens App B, which redirects the browser to the same IdP.
- The IdP recognizes the existing session and returns fresh proof for App B — no second login, and App B gets its own assertion.
What to remember
- It is
- A user experience — one authentication session unlocks many apps.
- It is not
- A wire protocol. There is no “SSO spec” to implement.
- Built with
- OIDCSAMLand sometimes Kerberos.
- Watch for
- Session lifetime and single-logout are the hard parts, not the login itself.
OAuth 2.0RFC 6749 · Authorization FrameworkAuthorization
Authorization Code flow (with PKCE)
- App A (the client) needs data or actions from App B on the user’s behalf.
- It redirects the user to App B’s authorization server with the scopes it wants.
- The server authenticates the user if needed and obtains consent for those scopes (a prompt may appear).
- The client exchanges the returned code for an access token that authorizes API access — but isn’t standardized proof the user authenticated.
- App A calls App B’s API with the token to act within the granted scopes.
What to remember
- Answers
- “May this app access this?” — not, on its own, “who authenticated to the app?”
- Issues
- access_tokenrefresh_token
- Roles
- Client · Resource Owner · Authorization Server · Resource Server.
- Watch for
- Using an access token to identify the user is a classic security bug — that’s what OIDC exists to fix.
OIDCOpenID Connect · layer over OAuth 2.0Authentication
Typical flow
- User authenticates at the IdP (this is an OAuth authorization request with an
openidscope). - The IdP returns an ID token — a signed JWT with claims about the authentication event and subject — plus, typically, an access token for an API or the UserInfo endpoint.
- App validates the ID token — signature, issuer, audience, expiration, and applicable nonce — then uses
subto identify the authenticated user. - App uses that identity to create a session, assign roles, and personalize.
What to remember
- The upgrade
- Adds standardized identity to OAuth, so login is done safely.
- Issues
- id_token (JWT)for login, plus anaccess_tokenfor APIs.
- Format
- HTTP, JSON & JWT based — well suited to modern web, mobile and SPA apps.
- Use when
- “Log in with Google/Apple,” consumer apps, modern SSO.
SAML 2.0Security Assertion Markup Language · XML federationAuthentication
SP-initiated flow
- User hits the app (the Service Provider) and is redirected to the IdP.
- User authenticates if needed; the IdP returns a signed SAML response containing an assertion (XML) via the browser.
- The app validates the signature and extracts the user’s identity and attributes.
What to remember
- Overlaps with OIDC
- Both do federated authentication + SSO. SAML is the older, XML-based way.
- Carries
- SAML assertion (XML)
- Roles
- Identity Provider (IdP) ↔ Service Provider (SP).
- Use when
- Enterprise/workforce SSO, established B2B integrations.