I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to other STSs such as CA Siteminder, Ping Identity, ADFS and others. Here is the selection I see in my configuration portal:
The corresponding help link takes me to MSDN documentation that doesn't cover security questions like this.
Is the difference in Token Format merely the manner in which it is serialized:
- The size of the token (that may round trip to the browser)
- Fundamental differences in security
- Differences in features and functionality
I have heard in several MSFT talks that SWT is an overly simplified version of SAML, and JWT is a not-yet-finalized standard by Google, IBM, and MSFT that should compromise on features between SWT and SAML.