SAMLOIDC

SAMLOIDC is a federation pattern that enables interoperability between SAML 2.0 and OpenID Connect (OIDC) ecosystems. In practice, it describes a setup where a gateway or bridge translates authentication events and claims between SAML-based identity providers and OIDC-based relying parties, allowing single sign-on across apps that use different protocols. Some deployments treat SAMLOIDC as a product name, while others refer to the architectural pattern itself.

Typically, a SAMLOIDC implementation includes a gateway or intermediary component that sits between SAML IdPs and OIDC clients, and may also connect OIDC IdPs with SAML service providers. The gateway handles trust relationships, attribute mapping, and token or assertion translation. In a SAML-to-OIDC flow, a user authenticates via a SAML IdP; the gateway extracts usable attributes, maps them to OIDC claims, and facilitates an OIDC session with the target OIDC relying party, effectively producing an OIDC ID token for the client. In an OIDC-to-SAML flow, a user authenticates through an OIDC IdP, the gateway translates claims into a SAML assertion, and brokers the sign-on to a SAML SP.

Use cases include migrating applications from SAML to OIDC without rearchitecting all identities, providing a unified SSO experience for environments containing both SAML and OIDC apps, and enabling centralized governance over authentication across diverse clouds and platforms.

Key considerations include careful claim mapping and attribute release controls, strong TLS and certificate management, protection against token replay, and clear trust and metadata management. Limitations include potential complexity, partial feature parity between protocols, and the need for ongoing synchronization of attribute schemas.