ISC Identity · Updated November 2026

OAuth, SAML, or OpenID Connect: Authorization or Authentication?

The protocols overlap in modern identity systems, but they were designed around different primary purposes.

OAuth

OAuth lets a user authorize one application to access specified resources without giving the application the user's password.

OpenID Connect

OIDC builds an identity layer on OAuth 2.0 and can provide authenticated user identity information through identity tokens.

SAML

SAML exchanges signed assertions between identity providers and service providers and is common in enterprise federated SSO.

Exam strategy

Ask whether the problem is mainly about delegated resource access, user identity, or enterprise federation.

The takeaway

OAuth is primarily an authorization framework. OpenID Connect adds identity on top of OAuth. SAML is a federated authentication and authorization standard commonly used for enterprise SSO.

Related Summit guides

SSO vs federationContinue with a related Summit CPA Review guide.Authentication factorsContinue with a related Summit CPA Review guide.Zero trustContinue with a related Summit CPA Review guide.

FAQ

Is OAuth primarily an authorization framework?

Yes.

Does OpenID Connect add identity to OAuth?

Yes.

Can SAML support enterprise SSO?

Yes.