OAuth working with eg

 Authorization:

OAuth is an open-standard authorization protocol or framework that provides applications the ability for “secure designated access.” like taleo uses linkedin to fetch user's details.

SAML (Security Assertion Markup Language) is an alternative federated authentication standard that many enterprises use for Single-Sign On (SSO). SAML enables enterprises to monitor who has access to corporate resources.

Diff b/w OAuth and SAML:

SAML uses XML to pass messages, and OAuth uses JSON.

OAuth provides a simpler mobile experience, while SAML is geared towards enterprise security.

OAuth uses API calls extensively and SAML drops a session cookie in a browser that allows a user to access certain web pages.

OAuth working with eg:

Taleo(Customer) - LinkedIn(Service Provider)

1. Taleo asks for REQUEST TOKEN.

2. LinkedIn provides the request token and SECRET. The secret is used to prevent request forgery.  The consumer uses the secret

 to sign each request so that the service provider can verify it is actually coming from the consumer application.

3. Taleo redirects to Linkedin with token for authorization. Here phishing can occur, beware of redirected URLs.

4. User login to Linkedin to authorize the token.

5. Linkedin provides access token and secret

6. Taleo can use access token to fetch Linkedin API data.