Can't we use SAML for securing microservices?

user_2046462 0
Viewed 1257

Currently, Oauth2 is becoming the de facto for the security module for the microservices ecosystem.

Why can't we replace Oauth with SAML (or any other SSOs for that matter) and JWT with SAML Assertions (or equivalent data of the SSOs)?

Is it the simplicity of Oauth2 that makes us chose it or is there any other reasons not to use SSOs in place of Oauth for microservice authentication and authorization.

saml-2.0 microservices jwt oauth-2.0 single-sign-on
1 Answers

The main reason is that SAML and WS-Fed typically rely on browser redirects to function.

OAuth is simple REST.

That said, if the IDP allows it, you could authenticate with SAML, get a SAML token, ask for the equivalent JWT token and then use that for the API.

nzpcmad_99220
Related