How did SAML evolve from version 1.0 to 2.0, and how compatible are the versions?

SAML 1.0 became an OASIS standard in November 2002, SAML 1.1 followed in September 2003 and SAML 2.0 in March 2005; 1.0 and 1.1 are similar, but 2.0 is not compatible with 1.1, and all versions are still in use.

* SAML 2.0 is a merger: OASIS SAML 1.1, the Liberty Alliance's ID-FF and Shibboleth fed into it. *

Work began in 2001. Two parallel communities then extended SAML 1.x in different directions:

• The Liberty Alliance built the Identity Federation Framework (ID-FF 1.0 to 1.2) on top of SAML 1.0/1.1, adding federation features such as pseudonymous identifiers and single logout.
• The Shibboleth project (from the US research and education community) built privacy-preserving federated login for universities on SAML 1.1.

SAML 2.0 merged these strands back into one standard. That is why 2.0 brought so much that 1.1 lacked (single logout, metadata, pseudonymous name identifiers, encryption) and also why it is not backwards compatible: the message formats and namespaces changed. A product that only speaks SAML 1.1 cannot talk to a SAML 2.0-only partner, which is why long-lived deployments may still run older versions side by side.

Go deeper:

• Security Assertion Markup Language: History and Versions (Wikipedia) — the timeline and what changed between 1.1 and 2.0.
• Liberty Alliance (Wikipedia) — the industry consortium whose ID-FF fed into SAML 2.0.
• Shibboleth (Wikipedia) — the research and education SSO system that shaped SAML 2.0.