Question
What is SAML 2.0, and what problem does it solve?
Answer
SAML (Security Assertion Markup Language) is an open, XML-based OASIS standard for exchanging authentication and authorisation information as signed "assertions", most famously to enable browser-based single sign-on across organisations.
Without a common language, every application that wants to rely on someone else's login has to build a custom integration. SAML gives the two sides a shared vocabulary and a set of message formats:
- One party, the identity provider (IdP), authenticates the user.
- It then writes a SAML assertion: an XML document that says, in effect, "I, the IdP, authenticated this user at this time with this method, and here are some attributes about them". The assertion is digitally signed.
- The service provider (SP), the application the user actually wants, checks the signature and lets the user in without ever seeing their password.
Three properties made SAML the backbone of enterprise and academic federation:
- Open and vendor-neutral: it is an OASIS standard, so a Microsoft IdP can log users into a Linux-hosted SaaS app and vice versa.
- XML-based: assertions and protocol messages are XML, which allows rich structure, XML Signature and XML Encryption, at the price of verbosity and parsing complexity.
- Browser SSO built in: the Web Browser SSO profile works with any unmodified browser, using only redirects and HTML forms.
Go deeper:
OASIS: SAML V2.0 Technical Overview — the official, readable introduction to the whole standard.
Auth0: How SAML Authentication Works (video) — a short visual walk-through of IdP, SP and the signed response.- Security Assertion Markup Language (Wikipedia) — overview of design, versions and use.
Note saved — thanks!
Question
In which two kinds of environment is SAML used, and how does message transport differ between them?
Answer
In web applications, where SAML messages travel over HTTP(S) through the user's browser, and in web services of service-oriented architectures (SOA), where they travel mainly inside SOAP messages.
| Environment | Who talks | Transport | Typical use |
|---|---|---|---|
| Web applications | Browser, IdP, SP | HTTP(S) redirects and form posts through the browser | Web single sign-on for people |
| Web services (SOA) | Service to service | SOAP envelopes, often directly between servers | A service passes a signed security token describing the caller to the next service |
The assertion itself is the same XML object in both worlds. What changes is the binding, the way it is carried: in the browser world it rides in an HTML form or a URL, in the SOA world it sits in the header of a SOAP message (this is what the WS-Security SAML Token Profile standardises).
Go deeper:
- Security Assertion Markup Language: Use (Wikipedia) — where SAML is deployed, from web SSO to web services.
- OASIS: SAML V2.0 Technical Overview — section 6 shows how SAML is profiled for WS-Security.
Note saved — thanks!