Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have any info/links on the relative security of SAML vs Kerberos. I believe I grasp the differences between the two, and what they mean for my particular application, but to decide between the two, knowing which is more secure, if either, would be a valuable bit of info.

share|improve this question
up vote 3 down vote accepted

From the top of my head:

  1. Kerberos is a lan (enterprise) technology while SAML is Internet.
  2. Kerberos requires that the system that requests the ticket (asks for user identity, in a way )is also in the kerberos domain, SAML does not require systems to sign up before.
  3. Kerberos does not reveal any identity information, because it does not know about anything beyond principal name.

In reality, SAML is for web apps and Kerberos is for unix/linux systems having SSO.

share|improve this answer
Kerberos is also for Windows domains, since it's built into AD. – mfinni May 26 '10 at 14:47
Kerberos is an authentication/authorization scheme; SAML is a standardized way to do security markings – mpez0 May 26 '10 at 15:34
Kerberos was created by MIT in the 1980s and was USURPED by Microsoft by changing a byte value specifically marked as unused/later expansion. Kerberos is showing its age and is not as detailed as SAML (see XACML / assertions) nor does Kerberos make any provision for 3rd parties. This is the official link for the latest iteration: – ArrowInTree Dec 21 '12 at 2:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.