What are the three types of statement a SAML assertion can carry?
- Authentication statement: the subject was authenticated at a certain time by a certain method.
- Attribute statement: arbitrary attributes of the identity, such as name, e-mail or account status.
- Authorisation decision statement: whether the subject may access a requested resource.
Authentication statement (<AuthnStatement>): the core of SSO. It does not transport credentials; it reports the fact and quality of a past login ("password plus OTP at 09:23:50").
Attribute statement (<AttributeStatement>): whatever the SP needs to personalise or authorise, for example givenName, mail, eduPersonAffiliation=staff. The IdP should release only what the SP needs (data minimisation).
Authorisation decision statement (<AuthzDecisionStatement>): the access decision is made not by the resource itself but by a trusted central instance, which says "subject X may perform action Y on resource Z".
An assertion may combine several statements; a typical SSO assertion carries an authentication statement plus an attribute statement.
Go deeper:
Security Assertion Markup Language: Assertions (Wikipedia) — the three statement types with examples.- OASIS: SAML V2.0 Technical Overview — section 4.4.2 shows assertion, subject and statement structure.