Standards and terminology
SAML, OIDC, OAuth and SCIM
What is the difference between SAML, OIDC, OAuth and SCIM?
SAML and OpenID Connect both handle authentication, proving who a user is to an application. OAuth 2.0 handles authorization, granting an application limited access to resources on a user's behalf. SCIM handles provisioning, keeping user accounts and group membership synchronized between systems. They solve different problems and are commonly used together.
| Protocol | Answers | Typical use |
|---|---|---|
| SAML 2.0 | Who is this user? | Enterprise application single sign-on, especially long-established software |
| OpenID Connect | Who is this user? | Modern web, mobile, and API-driven single sign-on, built on OAuth 2.0 |
| OAuth 2.0 | What may this application do on the user's behalf? | Delegated API access, and the base layer for OIDC and most agent access |
| SCIM | Which accounts should exist, with what attributes? | Automatic creation, update, and deactivation of accounts in downstream applications |
The most common confusion
OAuth 2.0 is not an authentication protocol. It was designed to delegate access to resources, and using it alone to establish identity is a well-documented source of security mistakes. OpenID Connect exists precisely to add a proper identity layer on top of it.
Authentication and provisioning are separate problems
Single sign-on gets a user into an application. It does not necessarily create their account, set their attributes, or remove them on departure. That is provisioning, and it is why SCIM matters: without it, an application can end up with accounts that persist after the central identity is disabled, which is exactly the leaver failure governance is meant to prevent.
Choosing for a new integration
- If the application supports OpenID Connect, prefer it for new work.
- If it only supports SAML, that is entirely acceptable and remains widely deployed.
- Add SCIM wherever the application supports it, because lifecycle automation depends on it.
- If it supports none of these, treat it as an exception needing a proxy or a documented compensating control.
Frequently asked
Is SAML obsolete?
No. It is mature rather than dead, and it remains the only federation option for a large amount of enterprise software. Preferring OIDC for new integrations does not require replacing working SAML ones.
Does SCIM handle groups?
Yes, group membership synchronization is part of the specification, though support varies considerably between applications. Verifying what a specific application actually implements is worth doing before planning around it.
What about LDAP and Active Directory?
They remain the directory and authentication backbone in many estates. Modern identity platforms typically federate to or synchronize with them rather than replacing them outright, particularly where on-premises applications still depend on them.
Last reviewed 2026-08-17 by the Axiom Identity practice.
Want this assessed in your own environment?
Reading about it is not the same as deciding it. The free CIAM assessment asks four quick questions and hands you a personalized report on the spot.