How do you implement SAML or OpenID Connect in your web development stack?

An example of SAML: Let's say you work for a company and need to access a third-party software application that your company uses. Instead of creating a separate login account for the application, your company can use SAML to enable you to log in with your existing company login credentials. When you try to access the application, you will be redirected to your company's SAML Identity Provider (IdP), where you will log in. Once you are authenticated, your company's SAML IdP will send a message to the third-party application's SAML Service Provider (SP) stating that you are authenticated and authorized to access the application

The ID token authenticates the user, while the access token authorizes the CLIENT APP to access other resources (such as an API) on behalf of the user. The access token is not a user authorization, it is a client’s delegated authorization. Also note that the access token is from the OAuth standard whereas the ID token is from the OIDC standard. A really awesome reference: https://auth0.com/blog/id-token-access-token-what-is-the-difference/

An example of OpenID: Suppose you want to sign up for a new social media website. Instead of creating a new account with a username and password, you can use your existing Google account credentials to sign in using OpenID. When you click on the "Sign in with Google" button, you will be redirected to Google's OpenID provider where you will log in. Once you are authenticated, Google's OpenID provider will send a message to the social media website's OpenID consumer stating that you are authenticated and authorized to access the site.

Because of these differences in capabilities the use cases for SAML and OIDC are a bit different. SAML has been around much longer and are primarily used in enterprise IT environments where the apps are pre-built and just need to be configured while OIDC tends to be used in custom application development where external consumers are the primary users. If you're trying to integrate your app to an internal enterprise identity management system such as Okta or Azure AD you can use either SAML or OIDC because those systems support both protocols. However if the app you're building will be used for end users to login using social sign in, those will most likely be OIDC implementations.

Enterprise-level identity federation uses SAML, a 2001 protocol. It exchanges authentication and authorization data via XML. SAML allows single sign-on (SSO) for various applications. Identity federation lets organizations trust each other's authentication and authorization systems. SAML is more configurable and integrates more features than OpenID Connect. OpenID Connect, a 2014 identity protocol based on OAuth 2.0, is newer. Web and mobile apps use it for lightweight and flexible user authentication. SAML enables SSO and identity federation, while OpenID Connect leverages JSON (JavaScript Object Notation) for data interchange, making it more suitable for online and mobile apps. It also expands social media integration.

To implement SAML in enterprise environment with Java EE you need to use a library which is still supported by commercial software company.Open source libraries are not the best choice because at some point some issues related to compliance or architecture of your environment may arise and open source maintainers will not be able to provide required level of support and perform changes needed for your usecase

There’s great info here; however, the title of the article makes me expect more of a ‘how-to’ guide, and instead it’s more of a ‘what-why’ guide. I expect that a dev who hasn’t implemented auth before will leave this article still fairly perplexed about how to move forward. Suggest either adding more step-by-step implementation instruction or changing the title to better set expectations.