What is SAML 2.0, and what problem does it solve?

SAML (Security Assertion Markup Language) is an open, XML-based OASIS standard for exchanging authentication and authorisation information as signed "assertions", most famously to enable browser-based single sign-on across organisations.

Without a common language, every application that wants to rely on someone else's login has to build a custom integration. SAML gives the two sides a shared vocabulary and a set of message formats:

• One party, the identity provider (IdP), authenticates the user.
• It then writes a SAML assertion: an XML document that says, in effect, "I, the IdP, authenticated this user at this time with this method, and here are some attributes about them". The assertion is digitally signed.
• The service provider (SP), the application the user actually wants, checks the signature and lets the user in without ever seeing their password.

Three properties made SAML the backbone of enterprise and academic federation:

• Open and vendor-neutral: it is an OASIS standard, so a Microsoft IdP can log users into a Linux-hosted SaaS app and vice versa.
• XML-based: assertions and protocol messages are XML, which allows rich structure, XML Signature and XML Encryption, at the price of verbosity and parsing complexity.
• Browser SSO built in: the Web Browser SSO profile works with any unmodified browser, using only redirects and HTML forms.

Go deeper:

• OASIS: SAML V2.0 Technical Overview — the official, readable introduction to the whole standard.
• Auth0: How SAML Authentication Works (video) — a short visual walk-through of IdP, SP and the signed response.
• Security Assertion Markup Language (Wikipedia) — overview of design, versions and use.