Great article but if I wanted to explain it to somebody in one sentence I'd say "It's like sign-in with google, but for enterprises", by "enterprises" i mean "more shit" - xml/soap/overcomplicated kind of shit.
Thankfully in the real world both seem to be implemented in the absolute minimal way to get things working.
We use it for Solvent (https://codesolvent.com) login to product instances and it works excellently.
There is still a lot work done to ensure keys are generated in the proper locations and that necessary product id values (corresponds to SAML SP entityID) are generated.
In short, it is not a simple plug-n-play, lots of hacking to get the result we needed but the adapter itself does what it needs to do.
Our clients are mostly SAML SaaS software and our own implementation of gatekeeper (which is also a kubernetes ingress) with short lifetime OIDC ID tokens, long lifetime refresh tokens and seamless background refreshing.
[0]: Thomas Pornin is far from average!
Or alternatively, why are you trusting new employees phones? That’s absolute insanity.
Are you suggesting "no creds that live outside of trusted elements physically tied to a device we own" is an ubiquitous property of access management?
I’ve never worked full time at a software company that allowed credentials on employee personal devices. Supposedly because most consumers are up to their eyes in malware, often from the moment they buy the devices, not because the employees are untrustworthy (it would be difficult to have a functioning business where you can’t trust the employees.)
Certificates are only more difficult because nobody seems to have put in the effort to automate them, and client software hasn't put in any effort to make the experience nice.