Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ?

Can somebody highlight their differences and point which technology is a better fit where.


update to add some context, there are some web services in an intranet environment where only a closed set of users should be allowed to access it. Is this requirement better suited for SAML or kerberos

share|improve this question

closed as too broad by Steve, Xander, TildalWave, Adi, AJ Henderson Feb 12 '14 at 15:16

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

You might be interested in Kerberos over the Public Internet, which bears on your question. – gowenfawr Feb 11 '14 at 18:14
This is somewhat of a broad question. – Steve Feb 11 '14 at 18:32
@gowenfawr your lead was very helpful, thanks. I have added some context to my question, its a closed system. so key exchange may be a possibility – mzzzzb Feb 12 '14 at 2:20

SAML is used over the Internet. If you have a web application you would use SAML. SAML is just a standard data format for exchanging authentication data. You would typically use it for a web SSO (single sign on).

Kerberos is used in an enterprise LAN typically. Kerberos requires that the user it is authenticating is in the kerberos domain.

Not really a lot of overlap in my opinion.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.