Difference between WS-Trust, WS-Fed and SAML 1.1/ 2.0 protocols

Question

What's the difference between WS-Trust, WS-Fed and SAML 1.1/ 2.0 protocols?

My understanding on these protocols gets confused when SAML is used as a security token in WS-Trust and WS-Fed protocols.

Interested in knowing in which scenario these protocols used and what makes them different. Your answers will be easy to understand if NO commercial product/ technology references used.

Answer 1

At a high level, WS-* protocols traditionally were used by Microsoft.

SAML-P (P for protocol) was used by the open source movement and hence Java.

WS-Fed has two profiles - active and passive. Active is for WCF (WS-Trust), passive is browser based (WS-Fed via login page).

Both of these use SAML tokens.

Functionally, both WS-Fed and SAML do the same thing wrt. federation

If you federate two ADFS (Microsoft IDP) together you use WS-Fed. If you add in Sharepoint, it also uses WS-Fed. The tokens passed are in the SAML token format.

If you have a Java application that uses Spring, then that will hook in to ADFS via SAML-P. The tokens passed are in the SAML token format.