zlacker

You said "OAuth only does authz and must be combined with other technologies to get authn"; obviously, that's not true, in the sense that you can simply use OIDC --- a dialect of OAuth --- to get both.

Since OIDC is better than SAML, which is probably the scariest security standard on the Internet, I think it's worth being clear to people that OIDC/OAuth is viable.

The SAML authz story, for what it's worth, is pretty shady.

>>tptace+(OP)
For sure. I never said SAML was any good -- I said I found it to be simpler. :)

>>kube-s+s2
For developers, they're both just libraries. As protocols to implement, SAML is drastically harder.