I am busy changing the world

To let my users login to Google Apps using Active Directory accounts, I can use SimpleSAMLphp as an IdP which gets identities from my Active Directory servers. Things are pretty easy with simplesamlphp, of-course: 1.  SimpleSAMLphp configurations: simplesamlphp/config/authsources.php : simplesamlphp/config/config.php : simplesamlphp/www/logout_relay.php : (because Google does not allow log out URLs that have question mark and parameters) 2. Google App settings: >> Go to https://admin.google.com and login as my Google App administrator account. >> Security -> Advanced Settings -> Setup Single Sign-on (SSO) : + Check "Enable Single Sign-on" + Sign-in page URL * https://mydomain.com/simplesaml/saml2/idp/SSOService.php + Sign-out page URL * https://mydomain.com/simplesaml/logout_relay.php + Change password URL * https://mydomain.com/ >> Click " Save changes " 3. NGINX server block for simplesamlphp: ...

Recently, I have a chance to work on a SSO system using SAML standard. Here are some good resources to get started with SAML: The SAML use case,  SAML Web Browser SSO :  this is the workflow of authenticating a user via a SSO system using SAML data format. Here is a visual explanation of SAML by Ping Identity: This is another video about SAML by Paul Moore, Centrify CTO and co-founder: And to differentiate between OpenID and SAML (from StackOverflow): They are two different protocols of authentication and they differ at the technical level. From a distance, differences start when users initiate the authentication. With OpenID, a user login is usually an HTTP address of the resource which is responsible for the authentication. On the other hand, SAML is based on an explicit trust between your site and the identity provider so it's rather uncommon to accept credentials from an unknown site. OpenID identities are easy to get around th...