Quiz Entry - updated: 2026.10.22
In which two kinds of environment is SAML used, and how does message transport differ between them?
In web applications, where SAML messages travel over HTTP(S) through the user's browser, and in web services of service-oriented architectures (SOA), where they travel mainly inside SOAP messages.
| Environment | Who talks | Transport | Typical use |
|---|---|---|---|
| Web applications | Browser, IdP, SP | HTTP(S) redirects and form posts through the browser | Web single sign-on for people |
| Web services (SOA) | Service to service | SOAP envelopes, often directly between servers | A service passes a signed security token describing the caller to the next service |
The assertion itself is the same XML object in both worlds. What changes is the binding, the way it is carried: in the browser world it rides in an HTML form or a URL, in the SOA world it sits in the header of a SOAP message (this is what the WS-Security SAML Token Profile standardises).
Go deeper:
Security Assertion Markup Language: Use (Wikipedia) — where SAML is deployed, from web SSO to web services.- OASIS: SAML V2.0 Technical Overview — section 6 shows how SAML is profiled for WS-Security.