SAML
An XML-based SSO standard (OASIS, 2005) where an identity provider sends a signed assertion about the user to a service provider.
In SAML 2.0 SSO the service provider redirects the user to the identity provider, which authenticates them and posts back a signed XML assertion containing the subject, attributes, audience and validity window. The service provider verifies the signature with the IdP's certificate and creates a session.
It remains the enterprise default for SaaS SSO, so you will integrate it even if you prefer OIDC. It handles authentication only; provisioning is SCIM's job.
Its XML complexity is the attack surface: XML signature wrapping (verifying one element, reading another), comment injection in NameID, accepting unsigned assertions, and XXE in parsers. Golden SAML attacks steal the IdP token-signing key (as in the SolarWinds intrusion) to mint assertions for anyone. Use a maintained library and never hand-roll verification.