SAML (Security Assertion Markup Language)

SAML (Security Assertion Markup Language)

šŸ” What is SAML?

Definition:
SAML (Security Assertion Markup Language) is an open standard for Single Sign-On (SSO) that allows identity providers (IdPs) to securely pass authentication and authorization data to service providers (SPs).

In simple terms:

SAML lets users log in once and access multiple web applications using their organizationā€™s credentials ā€” without needing separate usernames and passwords.

šŸ§© SAML Key Concepts

TermDescriptionExample
User / PrincipalThe person trying to access an appEmployee ā€œAliceā€
Identity Provider (IdP)Authenticates the user and issues identity dataOkta, Azure AD, Google Workspace
Service Provider (SP)The application the user wants to accessSalesforce, Zoom, Slack
AssertionA message (in XML) sent by the IdP to confirm the userā€™s identityā€œAlice has been authenticatedā€

āš™ļø How SAML Works (Step-by-Step Flow)

Letā€™s walk through an example:

Scenario:

Alice wants to access Salesforce, which uses Okta as the SSO provider.

Flow:

  1. User Accesses the App (SP-Initiated)
    • Alice goes to salesforce.com.
    • Salesforce sees sheā€™s not logged in and redirects her to the IdP (Okta).
  2. IdP Authenticates the User
    • Okta asks Alice to log in (username, password, MFA, etc.).
    • Once verified, Okta creates a SAML Assertion ā€” an XML document stating ā€œAlice is authenticated.ā€
  3. Assertion Sent to the Service Provider
    • Okta sends the signed SAML Assertion back to Salesforce via the userā€™s browser.
    • The assertion includes user details (like email, roles, and session info).
  4. Service Provider Grants Access
    • Salesforce validates the SAML Assertion using Oktaā€™s public key.
    • Alice is now logged in to Salesforce without needing a separate password.

šŸ§  SAML Message Types

  1. Authentication Request:
    Sent from SP ā†’ IdP (asking for user authentication).
  2. SAML Assertion:
    Sent from IdP ā†’ SP (contains authentication and authorization info).
  3. Response:
    The overall XML message that wraps the assertion.

šŸ§¾ Example of a Simplified SAML Assertion (XML)

<saml:Assertion>
  <saml:Subject>
    <saml:NameID>alice@company.com</saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="Role">Manager</saml:Attribute>
  </saml:AttributeStatement>
  <saml:AuthnStatement AuthnInstant="2025-10-09T10:00:00Z" />
</saml:Assertion>

This tells the Service Provider that ā€œAlice (alice@company.com) authenticated at 10:00 AM and has the role of Manager.ā€

āœ… Benefits of SAML

BenefitDescription
šŸ”’ Stronger SecurityAuthentication handled by a trusted IdP; no need to store passwords on each app.
šŸ‘¤ Single Sign-On (SSO)Users log in once to access many apps.
šŸ§© Centralized Identity ManagementEasier to add/remove users in one place.
šŸ“œ Audit and ComplianceAll authentication events logged by IdP.

āš ļø Limitations

LimitationDescription
šŸ—ļø Complex SetupRequires XML configuration and certificate exchange.
šŸŒ Web-CentricBest suited for browser-based (not mobile) apps.
šŸ§± Heavy XML FormatMore verbose compared to modern JSON-based standards like OIDC.

šŸ”„ SAML vs OAuth 2.0 vs OpenID Connect

FeatureSAMLOAuth 2.0OpenID Connect (OIDC)
PurposeAuthentication & SSOAuthorization (access delegation)Authentication (modern SSO)
FormatXMLJSONJSON
Common UseEnterprise web appsAPI access (mobile/web apps)Consumer SSO (Google, Facebook login)
ExampleLogging into Salesforce via OktaA third-party app accessing your Google DriveLogging into Reddit using Google

šŸ§± Real-World Example

  • A company uses Azure AD as the IdP and Salesforce, ServiceNow, and Workday as SPs.
  • Employees sign in once to Azure AD ā†’ gain access to all these apps automatically using SAML SSO.

Leave a Reply