SAMLpåstander

SAMLpåstander, or SAML assertions, are the core of the Security Assertion Markup Language (SAML) protocol. They are XML-formatted statements that an identity provider (IdP) makes about a user, asserting specific information to a service provider (SP). These assertions are used to authenticate users and provide authorization information, enabling single sign-on (SSO) capabilities.

A SAML assertion typically contains three main types of statements: authentication statements, attribute statements, and authorization decision statements. An authentication statement confirms that the user was authenticated by the IdP at a particular time and by a specific method. An attribute statement provides details about the user, such as their name, email address, or group memberships. An authorization decision statement declares whether the IdP permits or denies the user access to a specific resource.

The structure of a SAML assertion includes elements like Issuer, Subject, Conditions, and Advice. The Issuer identifies the entity that created the assertion. The Subject identifies the principal (user) to whom the assertion applies. Conditions specify the circumstances under which the assertion is valid, such as audience restrictions and validity periods. Advice may contain additional information that the IdP deems relevant.

SAML assertions are digitally signed by the IdP to ensure their integrity and authenticity, preventing tampering and verifying that they originated from a trusted source. Service providers rely on these signed assertions to grant access to protected resources without requiring the user to re-authenticate. This mechanism is fundamental to modern federated identity management systems.