Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider.

We are considering adding OAuth in order to support some mobile applications. (We don't want the user to have to log in constantly.)

It's pretty obvious how it will all work together when we are using our own Username/Password authentication, since we are in control of the entire stack.

How will OAuth interact with SAML2 SSO though? For instance, what should be done to invalidate OAuth grants if the Identity Provider removes a user? What other gotchas (and hopefully standard solutions) are there?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

The only implementation of this combination that I know about is Salesforce. What you are looking to do is a complex setup - both protocols are not simple and there are issues in their interaction, such as the one you've mentioned.

Have a look at this document (what SF implementation looks like from outside) - https://wiki.developerforce.com/page/Single_Sign-On_for_Desktop_and_Mobile_Applications_using_SAML_and_OAuth

and check this draft (I personally had not dug through it, but it's specifically addressing your case https://tools.ietf.org/html/draft-ietf-oauth-saml2-bearer-16

share|improve this answer
Great, just what I needed. –  brendanjerwin Apr 8 '13 at 19:01
add comment

OAuth is an authorization frame work. from the RFC6749

The OAuth 2.0 authorization framework enables a third-party application to obtain limited access to an HTTP service

And SAML is an authentication framework. SAML assertions contain authentication information.Commonly SAML is used for SSO but the SAML standard also contains an Authorization decision assertion. Which may be used for carrying some authorization information.

You can get more information from the SAML documentation here.

The question does not give details about the implementation of your system but I would suggest using authorization capabilities of SAML 2.0 rather than trying to merge two entirely different standards that serve different purposes

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.