The appeal of a cutover date is obvious: one weekend, one switch, everything new afterwards. In practice it means every fault appears at the same moment — across every application at once.
Why parallel operation is the cheaper option
SAML and OpenID Connect can run side by side against the same identity service. One application is migrated, observed, and only then the next one. If something surfaces, it affects exactly one application.
Decision
Parallel operation costs time in the project plan and saves it during an incident. A cutover date trades those two entries.
What has to be settled first
The source of record for users. If the directory is the truth, the migration only changes the protocol. If it is not, a migration is the wrong moment to find out.
The role model. SAML attributes and OIDC claims are not the same thing. The mapping has to be explicit rather than implied by matching names.
Logout behaviour. Single logout behaves differently in the two protocols. Checking that after the switch means explaining it to support afterwards.
Map attributes deliberately
The mapping from directory attributes to claims belongs in documentation, not only in configuration:
| Directory | SAML attribute | OIDC claim |
|---|---|---|
uid |
NameID |
preferred_username |
mail |
emailAddress |
email |
memberOf |
Group |
groups |
Note
A claim called
groupsin one application androlesin another is not a detail. It is the most common cause of "works for me, not over there".
The order that works
- Configure the identity service to serve both protocols.
- Move one non-critical application to OIDC and observe it in production.
- Verify the attribute mapping against real tokens, not against the documentation.
- Migrate the remaining applications one at a time.
- Disable SAML clients only once the logs show no sign-ins going through them.
In practice
Step 5 gets skipped regularly. A look at the identity service's sign-in logs answers in a minute whether an application has really been migrated.
Context
Migrations like this touch operations, permissions and application development at the same time. The identity & access management page describes how those areas connect.