What is SAML metadata, and what information does it exchange between federation partners?

SAML metadata is a standard XML format in which IdPs and SPs describe their configuration to each other: entity ID, endpoints with their bindings, supported name identifier formats and the certificates used for signing and encryption.

Before any login can happen, each side needs to know facts about the other: "where do I send the AuthnRequest?", "which certificate signs your assertions?", "where do I post the response?". Exchanging these by e-mail and manual configuration does not scale and is error-prone, so SAML 2.0 standardised them as an <EntityDescriptor>:

• entityID: the unique name of the party, used as Issuer and Audience.
• Role descriptors: <IDPSSODescriptor> (with SingleSignOnService endpoints) or <SPSSODescriptor> (with AssertionConsumerService endpoints), each endpoint tagged with its binding.
• <KeyDescriptor>: the X.509 certificates for signing and encryption. This is how trust is anchored: the SP trusts an assertion because it verifies with a key from the IdP's metadata.
• SingleLogoutService, supported NameIDFormat values and contact information.

Large federations publish signed metadata aggregates listing all members. The Swiss academic federation (Switch edu-ID, formerly SWITCHaai), for example, regenerates its aggregates hourly and asks members to refresh at least daily, so a new or revoked certificate propagates quickly.

Go deeper:

• SAML metadata (Wikipedia) — the metadata format with IdP and SP examples.
• Switch edu-ID: Metadata — how a real federation publishes and signs its metadata.
• OASIS: SAML V2.0 Metadata (PDF) — the normative schema.