oidc

The article critiques the SAML authentication protocol for its design flaws and complexity, advocating for its deprecation in favor of modern alternatives like OpenID Connect.

This blog post argues that GitHub Actions lacks static OIDC audience constraints, unlike GitLab CI/CD, and that this design weakness poses an increasing security risk as OIDC-based federation becomes more common.

The author explains the differences between SSO, OAuth, OIDC, and SAML, clarifying that SSO is a user experience, OAuth is for authorization, OIDC provides identity on top of OAuth, and SAML is an older enterprise protocol.

The article criticizes the misinterpretation of Trusted Publishing as a human trust mechanism, clarifying that it is a machine-to-machine OIDC-based authentication scheme that improves security by eliminating long-lived credentials.

AGG Identify is a lightweight and secure OIDC and OAuth2 provider.

Logto is an open-source auth infrastructure for SaaS and AI apps, supporting OIDC, OAuth 2.1, SAML, multi-tenancy, enterprise SSO, and RBAC.