What are the four nested building blocks of the SAML framework, and how do they relate?

Assertions (the statements) sit inside protocols (request/response pairs), which are carried by bindings (mappings onto HTTP or SOAP), which are combined into profiles (recipes for a concrete use case).

* Each layer uses the one inside it: a profile picks protocols and bindings, a protocol carries assertions. *

Read it from the inside out:

1. Assertions: what is said. Authentication, attribute and authorisation-decision information about a subject.
2. Protocols: how to ask and answer. Request/response pairs for obtaining assertions and managing the federation, for example <AuthnRequest> and <Response>.
3. Bindings: how the messages travel. How a protocol message is mapped onto a standard transport, for example HTTP Redirect, HTTP POST or SOAP.
4. Profiles: how it all combines for one use case. Which protocols, bindings and assertion contents to use, with which constraints, for example the Web Browser SSO profile.

The layering is what makes SAML reusable: the same assertion format serves browser SSO, web services and logout; only the outer layers change.

Go deeper:

• OASIS: SAML V2.0 Technical Overview — section 4.3 describes the components and their relationship.
• Security Assertion Markup Language: Design (Wikipedia) — the same four building blocks in encyclopedia form.