SAML vs OAuth vs OpenID Connect: A CISSP Decision Guide

SAML 2.0 exchanges XML assertions between identity providers and service providers and is widely used for federated web single sign-on. OAuth 2.0 is a framework for delegated access to protected resources. OpenID Connect (OIDC) adds an identity layer to OAuth 2.0 so a client can verify an end user’s authentication through an ID token. These standards can coexist; the exam distinction is the requirement each one solves.

Choose by the requirement

“Single sign-on” alone is not enough to choose a protocol. An implementation may use SAML or OIDC depending on the application and identity architecture. Look for the actual artifact and trust relationship described in the scenario.

Two common exam traps

First, an OAuth access token is not automatically proof of authentication to the client. OAuth describes delegated authorization; OIDC defines the ID token and related rules for authentication. Second, an OAuth access token is not necessarily a JWT. Its format depends on the authorization server and resource server arrangement. Do not infer a token’s purpose or format from the word “token” alone.

SAML assertions can carry authentication and attribute information for federation. A service provider must validate an assertion under its established trust configuration before using it. In all three approaches, protocol choice does not replace careful validation of issuer, audience, expiration, and other applicable security checks.

Worked CISSP-style question

A company’s reporting application needs permission to read a user’s files from a separate cloud service. The reporting application should not receive the user’s password, and the requirement is access to the files rather than proof of the user’s identity. Which framework best fits?

1. OAuth 2.0 delegated authorization.
2. SAML web single sign-on.
3. OpenID Connect authentication alone.
4. A shared administrator password.

Best answer: A. The application needs limited access to a protected resource without receiving the user’s credentials. B addresses federated sign-in to an application. C can establish identity but does not by itself express the resource-access requirement. D expands privilege and exposes a shared secret.

Decision rule: identify whether the question asks “May this client access the resource?” or “Who authenticated?” before matching the protocol.

Primary references and practice

The OASIS SAML technical overview, OAuth 2.0 RFC 6749, and OpenID Connect Core define these roles. Continue with the free Domain 5 practice questions or the broader IAM guide.