openskills.info
Course catalog
SAML logoCourse Preview

SAML

SAML is an XML-based standard for passing signed identity statements between an identity provider and an application. It commonly lets employees use one organizational sign-in to reach separate web applications without giving each application the organizational password.

itIdentity, access, and cryptography

SAML

Security Assertion Markup Language, or SAML, is an XML-based framework for exchanging authentication, attribute, and authorization information across security domains. Its most familiar use is enterprise web single sign-on. An identity provider authenticates a person and issues a SAML assertion. A service provider consumes that assertion and creates its own application session.

SAML separates authentication from application access. The service provider does not receive the user's identity-provider password. Instead, the two organizations establish trust in advance by agreeing on identifiers, endpoints, bindings, and signing keys. This federation arrangement lets one identity provider serve many applications while each application retains control of its local session and authorization rules.

The actors and trust boundary

Three actors participate in browser single sign-on:

  • The principal is the person whose identity is being asserted.
  • The identity provider, or IdP, authenticates the principal and issues assertions.
  • The service provider, or SP, protects the application and consumes assertions.

The browser carries protocol messages between the IdP and SP, but it is not trusted to decide what they mean. The SP validates the response against its configured trust information. A valid signature proves that signed content came from the holder of the configured private key and was not altered. It does not prove that every assertion is acceptable for every SP. The consumer must also validate issuer, audience, destination, time conditions, subject confirmation, and correlation data where the profile requires them.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources