What is SAML?
Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. It enables Single Sign-On (SSO) by allowing identity providers to pass authentication tokens to service providers.
SAML Components
Identity Provider (IdP) Authenticates users and issues assertions. Examples: Okta, Azure AD, OneLogin
Service Provider (SP) Relies on IdP for authentication. Examples: Salesforce, Slack, AWS
Assertions XML documents containing:
- Authentication statements
- Attribute statements
- Authorization statements
SAML Flow
- User accesses service provider
- SP generates SAML request
- User redirected to IdP
- User authenticates with IdP
- IdP generates SAML assertion
- Assertion sent to SP
- SP validates and grants access
SAML vs. OAuth/OIDC
| SAML | OAuth/OIDC |
|---|---|
| XML-based | JSON-based |
| Enterprise focus | Modern apps focus |
| More complex | Simpler |
| Mature standard | Newer standard |
| Web browser SSO | APIs and mobile |
Security Considerations
- Assertion signature validation
- Certificate management
- Replay attack prevention
- Secure attribute handling
- Proper logout implementation
Common Vulnerabilities
- XML signature wrapping
- Missing signature validation
- Assertion replay
- Comment injection