SAML
SAML is an XML-based standard for exchanging authentication and authorization assertions between an identity provider and a service provider.
Definition
Security Assertion Markup Language (SAML) is a standard for federated identity: an identity provider (IdP) authenticates a user and sends a signed XML assertion to a service provider (SP) asserting the user identity and attributes. The SP trusts the IdP and grants access without ever seeing the password. SAML 2.0 remains the dominant protocol for enterprise single sign-on, where organisations connect an IdP such as Entra ID or Okta to many SaaS applications.
Context and scope
Enterprise single sign-on and federated access across organisational boundaries, especially where an IdP must assert group and role attributes.
Common misconceptions
- SAML authenticates the SP to the IdP — the assertion flows from IdP to SP; the SP trusts the IdP, the reverse is different
- SAML is obsolete next to OAuth — SAML dominates enterprise browser SSO; OIDC is growing but does not erase it
- XML signatures can be checked loosely — signature wrapping and canonicalisation flaws are historical SAML attack vectors, so validation must be strict
Anti-patterns
- Not verifying the XML signature and the assertion conditions, accepting forged assertions
- Using IdP-initiated flows where SP-initiated with CSRF protection is safer
- Mapping arbitrary IdP attributes to privileges without an allowlist
Related concepts
Authoritative source
https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language
What it is
SAML 2.0 defines an XML protocol for an identity provider to tell a service provider who a user is and what they may do. The user authenticates once at the IdP; on success the IdP issues a signed assertion containing the subject and attributes and delivers it to the SP, often through the browser in a POST binding. The SP validates the XML signature, the issuer, the audience, and the time conditions, then establishes its own session. Attributes such as group membership let the SP make authorisation decisions.
Why it matters
Enterprises need one identity and one set of credentials across dozens of SaaS applications, and they need to deprovision access centrally when someone leaves. SAML federated SSO provides that: the IdP becomes the single place where authentication, MFA, and group membership are managed, while each SP trusts assertions rather than storing passwords. It is the substrate of most large-enterprise single sign-on today.
How to use it well
Verify assertions strictly: reject unsigned assertions, check the signature against the IdP certificate, confirm audience and recipient, and enforce NotBefore and NotOnOrAfter. Prefer SP-initiated flows with a CSRF-protected request to avoid unsolicited assertions. Map attributes to privileges through an explicit allowlist rather than trusting arbitrary values, support certificate rollover for the IdP, and automate user lifecycle so deprovisioning at the IdP propagates to access.