🔐SAML

NEW

Also known as: Security Assertion Markup Language

An XML-based standard for exchanging authentication and authorization data between parties.

DESCRIPTION

SAML is an OASIS standard enabling federated identity by exchanging authentication assertions from an Identity Provider to a Service Provider. It underpins single sign-on for enterprise and education ecosystems. SAML 2.0 defines protocols, bindings, and profiles using XML and often relies on browser redirects. Modern alternatives include OpenID Connect using JSON and REST.

ALTERNATIVE DEFINITIONS

OASIS

Security Assertion Markup Language (SAML) is an XML-based framework for communicating user authentication, entitlement, and attribute information.

Standard’s scope includes authentication and attribute transfer.

Source

Microsoft Learn

SAML is an XML-based protocol used for authentication and authorization between identity providers and service providers.

Practical framing for cloud identity federation.

Source

RELATED TERMS

Single Sign-On Identity Provider Service Provider Federation OAuth 2.0 JWT Assertion Metadata

COMPETING TERMS

OpenID Connect WS-Federation

KNOWLEDGE AREAS

Data Security Data Privacy & Compliance Software Engineering Infrastructure Cloud

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer Application Administrator Cloud Architect Chief Information Security Officer IT Manager

EXTERNAL SOURCES

• Wikipedia - SAML 2.0
• OASIS - SAML 2.0 official specifications
• Microsoft - Azure Entra SAML protocol guide

TOP QUESTIONS

How does SAML enable Single Sign-On?

An Identity Provider authenticates the user and issues a signed SAML assertion to a Service Provider, establishing a session without re-entering credentials.

Category: Definition

What is currently a hot topic around SAML?

Migration from SAML to OpenID Connect for modern web and mobile apps is common, focusing on JSON tokens and RESTful flows.

Category: Topic

What are SAML assertions?

Assertions carry authentication statements, attribute statements, and authorization decision statements, signed by the Identity Provider.

Category: Definition

What are common mistakes when implementing SAML?

Incorrect clock skew handling, insecure redirect URIs, misconfigured certificates, and weak signature validation cause security issues.

Category: Mistakes

What risks exist with SAML?

Replay attacks, XML signature wrapping, and misconfiguration can compromise sessions; strict validation and TLS mitigate risks.

Category: Risks

How does SAML compare to OpenID Connect?

SAML uses XML and browser redirects; OIDC uses JSON and OAuth 2.0. OIDC is often preferred for modern SPAs and mobile apps.

Category: Alternatives

What is SAML metadata?

Metadata describes entities, endpoints, keys, and supported profiles, enabling trust configuration between IdPs and SPs.

Category: Definition

How is SAML managed in the enterprise?

Centralize IdP configuration, enforce certificate rotation, monitor assertions, and audit SP integrations for compliance.

Category: Management

Where should teams learn about SAML?

Start with OASIS specifications and vendor guides (Microsoft, Okta). Practice with test IdPs and SPs in a non-production environment.

Category: Learning