What is SAML?
Also known as: Security Assertion Markup Language
SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider, enabling single sign-on across domains.
SAML, short for Security Assertion Markup Language, is an XML-based enterprise federation protocol defined by OASIS. It allows an identity provider (IdP) to issue signed assertions that a service provider (SP) can use to grant access to applications or resources. The protocol was first standardized in 2002, with SAML 2.0 (released in 2005) being the most widely deployed version.
SAML works through a flow where a user attempts to access a resource on a service provider. The SP generates a SAML authentication request and redirects the user to the IdP. The IdP authenticates the user (often via username/password, multifactor, or another method) and then produces a SAML assertion containing the user's identity, attributes, and optionally authorization statements. This assertion is digitally signed by the IdP and sent to the SP via the user's browser using HTTP POST or redirect bindings. The SP validates the signature, extracts the user information, and establishes a session.
SAML sits in the security layer above HTTP and is commonly used in enterprise single sign-on (SSO) scenarios, particularly for cloud applications, federated identity management, and government systems. It is often compared to OAuth 2.0 and OpenID Connect, but SAML is designed for enterprise environments with complex trust relationships and strict security requirements. The protocol uses XML Signature and XML Encryption for message integrity and confidentiality, and it relies on a pre-established trust relationship between the IdP and SP, usually configured via metadata exchange.
Key facts
- SAML 2.0 was standardized by OASIS in 2005 and remains the dominant version.
- Uses XML-based assertions signed by the identity provider for security.
- Enables cross-domain single sign-on without sharing user credentials directly.
- Supports multiple bindings: HTTP Redirect, HTTP POST, and Artifact.
- Defines three assertion types: authentication, attribute, and authorization decision.
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OAuth 2.0
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
OpenID Connect
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.