SAML

Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties, with a focus on web browser single sign-on. It enables a user to log in once to an identity provider (IdP) and to access multiple service providers (SPs) without re-authenticating. The standard defines the structure of the data exchanged, the protocols used to request and deliver it, and the bindings that transport messages.

Key concepts include assertions, which are statements about a user’s identity and attributes; the SAML protocol, which prescribes how authentication and attribute statements are requested and delivered; bindings, which specify how SAML messages are transported (for example, via HTTP Redirect or POST); and profiles, which are combinations of assertions, protocols, and bindings for specific use cases. System metadata describes trust relationships, endpoints, and cryptographic keys.

In a typical web SSO flow, the service provider redirects the user to the identity provider for authentication. After successful sign-in, the IdP issues a signed SAML assertion and returns it to the SP, usually through the user’s browser. The SP validates the signature, applies the user’s attributes, and grants access based on the policy.

Security considerations include the need for strong trust management through metadata exchange and certificate management, protection of assertions against interception and replay, and proper handling of attributes. SAML 2.0, the widely deployed version, uses XML-based messages and supports multiple bindings and inter-domain federation.

SAML is commonly used for enterprise single sign-on and identity federation, enabling organizations to connect internal identities with cloud services and partner applications. It originated from OASIS and was refined into SAML 2.0 in the 2000s, gaining broad adoption in enterprise and cloud ecosystems.