Quiz Entry - updated: 2026.10.22
What is a SAML binding, and which standard bindings does SAML 2.0 define?
A binding specifies how SAML protocol messages are mapped onto a transport, typically HTTP or SOAP; SAML 2.0 defines HTTP Redirect, HTTP POST, HTTP Artifact, SOAP, Reverse SOAP (PAOS) and URI bindings.
A protocol says what to send (<AuthnRequest>, <Response>); the binding says how it gets there:
| Binding | How the message travels | Channel |
|---|---|---|
| HTTP Redirect | Compressed and encoded into a URL query parameter of a 302 redirect | Front (via browser) |
| HTTP POST | Base64-encoded in a hidden field of an auto-submitted HTML form | Front (via browser) |
| HTTP Artifact | Only a short reference travels via the browser; the message is fetched separately | Front + back |
| SOAP | Inside a SOAP envelope, directly between servers | Back (server to server) |
| Reverse SOAP (PAOS) | SOAP carried in HTTP responses, for smart clients | Client-mediated |
| URI | An assertion retrieved by dereferencing a URI | Back |
The front channel goes through the user's browser and needs no direct network link between the partners; the back channel is a direct server-to-server connection that keeps the message away from the browser.
Go deeper:
SAML 2.0: Bindings (Wikipedia) — Redirect, POST and Artifact with concrete HTTP examples.- OASIS: SAML V2.0 Bindings (PDF) — the normative definition of every binding.