SAML vs OAuth — Complete Protocol Comparison Guide

def recommend_auth_protocol(use_case):
    checks = {
        "is_enterprise_sso": use_case.get("enterprise_sso", False),
        "needs_api_auth": use_case.get("api_auth", False),
        "needs_mobile": use_case.get("mobile", False),
        "needs_consumer": use_case.get("consumer", False),
        "has_existing_idp": use_case.get("existing_idp", False),
    }

    reasons = []

    if checks["is_enterprise_sso"] and checks["has_existing_idp"]:
        reasons.append("SAML for SSO with corporate IdP")
    elif checks["is_enterprise_sso"] and not checks["has_existing_idp"]:
        reasons.append("OIDC for SSO (simpler setup)")

    if checks["needs_api_auth"]:
        reasons.append("OAuth 2.0 for API authorization")

    if checks["needs_mobile"]:
        reasons.append("OAuth 2.0 + OIDC with PKCE for mobile")

    if checks["needs_consumer"]:
        reasons.append("OIDC for social login (Google, GitHub)")

    print("=== Authentication Protocol Recommendation ===")
    if not reasons:
        print("Start with session auth for simple web apps")
        return

    print("Recommended approach:")
    for i, reason in enumerate(reasons, 1):
        print(f"  {i}. {reason}")

    if "SAML" in str(reasons) and "OAuth" in str(reasons):
        print("\nNote: Use SAML for IdP-initiated SSO and OAuth 2.0 for API access")
        print("Consider bridging with an identity platform (Auth0, Okta)")

recommend_auth_protocol({
    "enterprise_sso": True,
    "api_auth": True,
    "mobile": True,
    "consumer": False,
    "existing_idp": True,
})

class HybridAuthBridge:
    """
    Bridge that supports both SAML (enterprise) and OAuth 2.0 (modern apps).
    Uses an identity platform that speaks both protocols.
    """

    def __init__(self):
        self.sessions = {}

    def saml_login(self, saml_assertion):
        """Handle SAML SSO from enterprise IdP."""
        name_id = self._extract_name_id(saml_assertion)
        email = self._extract_email(saml_assertion)
        groups = self._extract_groups(saml_assertion)

        session = self._create_session(email, groups)
        oauth_token = self._exchange_for_oauth_token(session)

        print(f"[Hybrid] SAML login: {email}")
        print(f"[Hybrid] Issued OAuth token for API access")
        return {"session": session, "access_token": oauth_token}

    def oauth_login(self, oauth_code, code_verifier):
        """Handle OAuth 2.0 / OIDC login from modern apps."""
        tokens = self._exchange_code(oauth_code, code_verifier)
        id_token = tokens.get("id_token")
        email = self._extract_from_id_token(id_token)

        session = self._create_session(email, groups=["external"])
        print(f"[Hybrid] OAuth login: {email}")
        return {"session": session, "tokens": tokens}

    def _create_session(self, email, groups):
        import secrets
        session_id = secrets.token_urlsafe(32)
        self.sessions[session_id] = {"email": email, "groups": groups}
        return session_id

    def _exchange_for_oauth_token(self, session):
        import jwt, time, secrets
        return jwt.encode({
            "sub": session, "type": "access",
            "exp": int(time.time()) + 900,
        }, secrets.token_hex(32), algorithm="HS256")

    def _extract_name_id(self, assertion):
        return "user@company.com"

    def _extract_email(self, assertion):
        return "user@company.com"

    def _extract_groups(self, assertion):
        return ["CN=Users,OU=Groups,DC=company,DC=com"]

    def _exchange_code(self, code, verifier):
        return {"id_token": "eyJ...", "access_token": "eyJ..."}

    def _extract_from_id_token(self, token):
        import jwt
        return jwt.decode(token, options={"verify_signature": False}).get("email")

import sys

class AuthProtocolAdvisor:
    def __init__(self):
        self.score = {"saml": 0, "oauth2": 0, "oidc": 0}

    def analyze(self, requirements):
        if requirements.get("enterprise_sso"):
            self.score["saml"] += 3
            self.score["oidc"] += 2

        if requirements.get("mobile_apps"):
            self.score["oauth2"] += 3
            self.score["oidc"] += 2

        if requirements.get("public_api"):
            self.score["oauth2"] += 3

        if requirements.get("social_login"):
            self.score["oidc"] += 3

        if requirements.get("microservices"):
            self.score["oauth2"] += 2

        if requirements.get("single_page_app"):
            self.score["oauth2"] += 2
            self.score["oidc"] += 2

        if requirements.get("existing_saml_idp"):
            self.score["saml"] += 3

        from collections import Counter
        return self.score

    def recommend(self):
        sorted_scores = sorted(self.score.items(), key=lambda x: -x[1])
        print("=== Auth Protocol Recommendation ===")
        print(f"\nProtocol scores:")
        for protocol, score in sorted_scores:
            bar = "#" * score
            print(f"  {protocol:8s}: {bar} ({score})")

        print(f"\nPrimary recommendation: {sorted_scores[0][0].upper()}")
        if sorted_scores[0][1] == sorted_scores[1][1]:
            print(f"Secondary: {sorted_scores[1][0].upper()} (tied)")

        if sorted_scores[0][0] == "saml":
            print("\nConfiguration notes:")
            print("- Set up SAML metadata exchange with enterprise IdP")
            print("- Implement SP-initiated and IdP-initiated SSO")
            print("- Issue OAuth 2.0 tokens after SAML auth for API access")
        else:
            print("\nConfiguration notes:")
            print("- Register OAuth 2.0 client with authorization code flow")
            print("- Implement OIDC discovery and JWKS verification")
            print("- Use PKCE for mobile and SPA clients")

advisor = AuthProtocolAdvisor()
advisor.analyze({
    "enterprise_sso": True, "mobile_apps": True,
    "public_api": True, "social_login": False,
})
advisor.recommend()