What is Security Assertion Markup Language (SAML)?

• Glossário do IAM
• What is Security Assertion Markup Language (SAML)?

Security Assertion Markup Language (SAML) is an open, XML-based standard that allows an Identity Provider (IdP) to securely pass a user's authentication and authorization data to a Service Provider (SP). Simply put, SAML is one of the main technologies that lets users sign in once and reach multiple applications without re-entering credentials.

What is SAML used for?

SAML is typically involved anywhere users need secure, streamlined access to multiple applications. The most common use cases are:

• Single Sign-On (SSO): A single login grants access to multiple applications, eliminating the need to re-enter credentials for each service.
• Federated identity: SAML lets an organization trust identities issued by a partner or parent company, so users from a trusted domain gain access without requiring separate accounts.
• Enterprise access management: IT teams gain central control over who can reach which applications by routing logins through a single IdP, helping enforce consistent policies like Multi-Factor Authentication (MFA) everywhere at once.

In each use case, the IdP issues a signed XML assertion that travels to the SP through the user's browser, which is how authentication data transfers securely without the user needing to log in again.

Key components of SAML

SAML exchanges generally involve the collaboration of several pieces. Here are some core terms that make the authentication process much easier to follow:

• Principal (subject): The user who is being authenticated, primarily a person trying to reach a specific application.
• Identity Provider (IdP): The system that verifies the user and issues the assertion, like Microsoft Entra ID or Okta, to allow the actual login to happen.
• Service Provider (SP): The application or website the user wants to reach, relying on the IdP to confirm the user's identity rather than managing login credentials.
• SAML assertion: The signed XML statement that the IdP sends to the SP, carrying the user's identity and authorization data (see more below).
• Metadata: The configuration both sides exchange ahead of time — endpoints, certificates, etc. — to demonstrate that the IdP and SP know how to trust and communicate with each other.
• Signing certificate: The digital certificate containing the public key the SP uses to verify the assertion's signature, establishing trust between the SP and the IdP to confirm the assertion wasn't altered in transit.

How does SAML authentication work?

SAML authentication works by passing a signed assertion from the IdP to the SP, confirming that the user is who they claim to be. The SP-initiated flow is the most common version of SAML authentication and starts when the user navigates to the website or application they want to use. If the application relies on an external IdP for login, it redirects the user's browser to the IdP with a SAML authentication request. The IdP then checks the user's credentials to authenticate them; if the user already has an active session, this step is skipped. Once the IdP is satisfied, it generates a signed assertion and sends it back through the browser to the SP. Lastly, the SP validates the assertion's signature, trusts it and lets the user in with no separate login necessary. While SP-initiated authentication is the most common for SAML, there is also an IdP-initiated flow, where the user begins at the IdP instead, like by clicking an application tile on a company dashboard.

What is a SAML assertion?

A SAML assertion is the signed XML document the IdP sends to the SP to vouch for a user. Every assertion can carry one or multiple statements, which are the actual pieces of information the SP uses to decide whether the user should be granted access. There are three types of statements:

• Authentication statements confirm who the user is, when they logged in and how (i.e., whether MFA was used).
• Attribute statements carry additional information about the user, such as their role or department. The SP can use these attributes to decide what the user can see or do.
• Authorization decision statements state whether the user is granted access to a certain resource. This type of statement is rarely used since more complex authorization is typically handled by eXtensible Access Control Markup Language (XACML).

SAML vs other authentication standards

SAML is often associated with other identity and access protocols that do related but distinct jobs. The main purpose of SAML is to handle authentication, proving who a user is and whether they're allowed into a website or application. Its authentication is what distinguishes it from OAuth, an authorization protocol that grants an application permission to access specific resources. SAML and OAuth are complementary rather than competing, with SAML confirming identity and OAuth granting access.

OpenID Connect (OIDC) is more similar to SAML since both authenticate users and enable SSO. However, OIDC is an authentication layer built on top of OAuth that uses JSON Web Tokens (JWTs) suited for modern web and mobile applications, whereas SAML's XML-based approach is still widely used for enterprise web SSO, though OIDC is increasingly the default for new applications. By comparison, Lightweight Directory Access Protocol (LDAP) is an older directory protocol that predates the cloud and is designed for on-premises environments. Instead of competing with SAML, LDAP often sits behind a SAML IdP as the source of user credentials.

Pros and cons of SAML

SAML simultaneously offers many advantages and trade-offs worth understanding before adoption.

Pros of SAML

SAML's largest benefit is that it minimizes the number of passwords users have to manage. With one login that grants access to multiple applications, users have fewer credentials to remember, minimizing the attack surface and reducing the risk of credential theft. Because authentication runs through a single IdP, organizations also gain centralized policy control; security teams can enforce MFA consistently across every connected application from one location. Having that centralization pays off, reducing help desk costs by lowering the password reset requests that generally overwhelm IT support.

Cons of SAML

SAML's advantages only present themselves when the markup language is configured correctly. It relies on XML Signature and XML Encryption for message integrity and privacy, along with TLS for transport security. One of the most common SAML vulnerabilities relates to misconfiguration, such as failing to properly validate signatures. Its XML-based model is less flexible than modern token formats, making SAML challenging to implement for mobile and single-page applications.