SSO Solutions

Question 1

XML

Answer 1

Extensible Markup Language. Data description and exchange language used by SSO applications to exchange information

Question 2

SAML

Answer 2

Security Assertion Markup Language: Uses XML to exchange authentication and authorization information between federated organizations.

Provides SSO for browser access.

Adopted by OASIS as a standard

Question 3

SAML Entities

Answer 3

Principle or User
Identity Provider
Service Provider

Question 4

SAML Assertions

Answer 4

Authentication
Authorization
Attributes

Question 5

OAuth 2.0

Answer 5

Authorization (not authentication) framework.
RFC 6749 and maintained by IETF
Authorizes one application to use another by issuing tokens

Question 6

OpenID

Answer 6

Maintained by OpenID foundation and not an RFC or IETF

Allows for decentralized authentication (not authorization) where you can login to multiple unrelated sites using credentials from an OpenID provider.

Uses your OpenID identifier.

Question 7

OIDC

Answer 7

OpenID Connect

Provides authentication and authorization services

This is how you can login to service using Google or Apple accounts.

Maintained by OpenID foundation

Uses JSON Web Tokens (JWT)

JWTs can provide information about the user as well