Enterprise
SAML
An XML-based federation standard, still the default for enterprise single sign-on.
What SAML means
SAML is the older enterprise federation standard, predating OAuth 2.0 and OpenID Connect and still what most large organisations' identity teams deploy. If your product sells to enterprises, you will be asked for SAML regardless of how modern your stack is.
Defined in: SAML 2.0, OASIS Standard (2005).
How it works
It works by exchanging signed XML assertions between an identity provider and a service provider. The concepts map roughly onto OIDC — an assertion plays the role of an ID token — but the encoding, the signature format and the metadata exchange are entirely different, which is why supporting both means two implementations rather than one with a flag.
It is not going away. It is deployed, it is understood by the people who run enterprise identity, and the replacement cost is enormous. Product teams that treat it as legacy discover it is a line item in the contract.
Implementing it safely is genuinely hard. XML signature wrapping, canonicalisation differences and assertion replay have all produced real authentication-bypass vulnerabilities in real libraries. This is not a weekend project.
The mistake people actually make
Validating an assertion's signature without verifying it covers the specific assertion element being trusted. Signature wrapping attacks exploit exactly that gap, and they have worked against widely used implementations.
In Authreads
How this applies here
SAML is on the roadmap as Planned — not built, and no date. /roadmap is the authoritative statement of that.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Related terms
SCIM
System for Cross-domain Identity Management — a standard API for provisioning and de-provisioning users automatically.
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
Single sign-on (SSO)
Authenticating once with a central provider and gaining access to multiple applications.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.