To me the SAML vs OIDC difference looks (also for the exchange format) pretty similar to the situations where XML vs JSON is used.
That is, I've always seen SAML as being very old / enterprise, and OIDC being the breath of fresh air that is JSON compared to XML.
I'd love to be proven wrong and start seeing SAML under a different lens as I don't currently see any benefit in starting a new project thst supports SAML
Tons of companies still use old school Active Directory for SAML -- and aren't even quite ready to migrate to Entra (formerly Azure Active Directory).
It's just a feeling seeing it mostly in banks and other old-school enterprises (AD plays a huge role here as you mentioned)
Hell, from a user perspective, I don’t even hate the Okta SAML implementation now we have support for Yubikey enabled. Click a button, I’m in.
This is a huge reason to support SAML, I agree. You can talk all day long about how OIDC is better, but if a customer or application only supports SAML, that's what needs to be implemented.
Especially since single sign-on is usually an enabler, not the whole value proposition of any application.