SAMLbased

SAML-based refers to systems that use the Security Assertion Markup Language (SAML), typically version 2.0, to enable federated authentication and single sign-on (SSO) across organizations. In such deployments, an identity provider (IdP) authenticates users and issues signed assertions to service providers (SPs).

In standard web browser flows, a user requesting access to an SP is redirected to the IdP with a SAMLRequest. After authentication, the IdP sends a SAMLResponse containing a signed assertion with the user identity and optional attributes. The SP validates the assertion and creates a local session. Messages travel via HTTP-Redirect or HTTP-POST, and federation metadata establishes trust between IdP and SP.

SAML 2.0 supports subject confirmation, attribute statements, and optional assertion encryption. Key data are carried in the Assertion element: Subject, Issuer, Conditions, and AttributeStatement.

Common use cases include enterprise SSO to cloud apps; IdPs include Okta, ADFS, and Ping Identity; SPs include Google Workspace, Salesforce, and Microsoft 365. SAML-based solutions enable centralized access control and cross-domain authentication.

Compared to OAuth and OpenID Connect, SAML-based authentication uses XML-based assertions and browser redirects rather than OAuth tokens. Strengths include broad enterprise support and strong trust relationships; drawbacks include setup complexity and reliance on XML tooling. Security considerations include signed and optionally encrypted assertions, short validity windows, and protection against replay attacks.