SAMLOpenID

SAMLOpenID is a conceptual interoperability approach designed to bridge SAML 2.0-based identity providers and OpenID Connect (OIDC) ecosystems. It describes a gateway or middleware that enables mixed-protocol federations, allowing organizations to migrate gradually from SAML to OIDC or to operate services that support both protocols without replacing existing IdPs or RPs.

In operation, a SAMLOpenID component acts as an intermediary between SAML IdPs and OIDC relying parties. It can accept a SAML assertion, validate its signature and audience, extract user attributes, and map those claims to standard OIDC fields such as sub, name, and email. The gateway then issues an OIDC ID token (and optionally access and refresh tokens) to the relying party. Conversely, it can translate an OIDC authentication request into a SAML authentication flow to accommodate SPs that only understand SAML. Through such translation, session management, attribute release, and provisioning can be coordinated across protocols.

Architecture typically includes the SAML IdP, an OIDC client or RP, and the SAMLOpenID gateway or bridge, supplemented by claim-mapping rules, metadata handling, and a policy engine. Additional components may provide logging, auditing, token caching, and audit trails to support governance and compliance.

Security considerations emphasize strict trust boundaries, robust signature verification, replay protection, accurate claim mapping, and careful handling of token lifetimes and sensitive attributes. Implementations should align with standard security practices for both SAML and OIDC, including PKCE for public clients, secure transport, and regular security testing.

This approach is most relevant for organizations undertaking gradual migration to modern federated authentication, enabling interoperability while preserving existing identities and services. See also: SAML 2.0, OpenID Connect, federation, claim mapping.