I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID.

I find it difficult to understand the difference between the two, regarding centralization. OpenID is said to be decentralized because it supports multiple entities which authenticate users. But this is also the case with SAML.

What makes OpenID decentralized and SAML centralized?

1 Answer 1


These are not really parallel technologies, but simplistically:

When you are using the SAML model, you typically respect a single issuer of SAML tokens (or perhaps a handful, but pre-defined by the service). That is, there is a single, central repository of user credentials, and all the "consumers" accept its' tokens and validate against that one.

With OpenId, you are typically accepting any OpenId provider, based on the user's input - it could be Google, or Facebook, or StackExchange, or your corporate OpenId provider, or your own home server. Either way, it doesn't matter.

This is not just a question of numbers, either. With SAML, you explicitly trust the SAML server to authenticate and verify your actual identity - which you can later rely on. With OpenId, you don't necessarily have any trust relationship with the OpenId provider - you accept whatever it tells you, and you don't actually care: you just need some form of assured identity (actually more of a "placeholder" in this case).

So, to sum up: SAML is centralized because you expect to control identities, OpenId is distributed because you have given up that control.

  • Ok, it seams like typically is the keyword here. Bacause with SAML you can have multiple and with OpenID you can choose to trust only one. May 5, 2014 at 9:53
  • You say that you dont have a trust relationship with openid providers. Isn't accepting whatever it tells you a typical trust? May 5, 2014 at 9:54
  • @Stefan True, you can change the numbers (as I mentioned), but that's not the important part - the model of your interaction with them is. I.e. even if you only accept one OpenID IdP, the model is still the same. As far as trust, this is really the core issue - with IdP you don't actually trust them to authenticate the user, you just don't care, and are willing to accept whatever they say. It's like the difference between the DMV and a local cinema: The DMV will insist on knowing for sure who you are, but if your friend says your name is John Smith, the cinema will be fine with that.
    – AviD
    May 5, 2014 at 10:16
  • But how can I not care about the authentication in OpenID? I Im going to use the authenticated user in my system I must be able to trust that the OpenID provider authenticates the user correctly. Dont I? May 5, 2014 at 13:28
  • 1
    @Stefan also note that this is one of the inherent drawbacks of the OpenId model, and what makes it not a good fit for certain scenarios. E.g. I would not recommend a bank allow it's customers to login via OpenID. See also my answer here, including the comments there.
    – AviD
    May 5, 2014 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.