The Security Assertion Markup Language (SAML) is an open standard that allows security credentials to be shared by multiple computers across a network. It describes a framework that allows one computer to perform some security functions on behalf of one or more other computers:
Authentication: Determining that the users are who they claim to be
Authorization: Determining if users have the right to access certain systems or content
Strictly speaking, SAML refers to the XML variant language used to encode all this information, but the term can also cover various protocol messages and profiles that make up part of the standard.
What is single sign-on (SSO)?
Single Sign-On allows users to be authenticated in multiple applications and services using a single set of credentials. Using SSO, a user signs in once on a login screen using their credentials and then can use several applications. The user does not have to confirm their identities for every application or service.
For all these mechanisms to work properly, the SSO system communicates with every external application and notifies them that the user is currently logged in; SAML comes into play.
SAML Concepts
When learning about SAML, there are few common concepts that one must understand before moving forward; these include:
Identity Provider (IdP)
This software performs the authentication process by validating credentials, verifying account status and invoking multi-factor authentication.
Service Provider (SP)
The service provider is the resource or web application where the user wants to login.
SAML Assertion
This is a message sent over HTTP via browser redirects asserting the user’s identity and other attributes.
Benefits of SAML
The most important benefit of SAML as a foundation for an SSO solution is that it is an open standard. As we’ve seen, that means that it can be implemented by a wide variety of IAM vendors, and integrated into all-encompassing systems like Salesforce. It also means that providers from different vendors can communicate with one another as long as they adhere to the SAML standard. Because SAML is an XML dialect, it’s also very flexible. All kinds of data can be transmitted in a SAML document, so long as it can be rendered in XML.