Hacker News new | past | comments | ask | show | jobs | submit login

Everyone supports SAML, not everyone supports OIDC, and for everyone besides GSuite SAML is absolutely still the default even from the IdP side.

There's a subtle difference where the de facto best practices deployment for SAML includes cryptographic audience restriction: each IdP/RP pair generates a key just for that interaction. With OIDC, GSuite (or whatever) authenticates you to the RP. With SAML, _a SAML configuration on your GSuite install does_. You want this, because optional (largely: non-cryptographic) audience restrictions fail more than half the time and when they do they fail open.

(If you're thinking "if that's true why isn't all of this just Kerberos": you're not wrong, at least from a protocol design perspective.)




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: