What is SAML?

Let's Start with SAML SAML stands for Security Assertion Markup Language. It’s an XML-based standard that enables secure authentication and authorization between different systems. As I'll explain in detail later, SAML facilitates the exchange of authentication data between an Identity Provider (IdP) and a Service Provider (SP). Using SAML allows sensitive authentication data to be handled safely and enables secure Single Sign-On (SSO) authentication. The Relationship Between SSO and OAuth To truly understand SAML authentication, you need to be familiar with the concepts of Single Sign-On (SSO) and OAuth. What is SSO? SSO allows users to access multiple systems or applications securely with just one login. It eliminates the need to remember separate login credentials for each service, making the user experience more convenient and improving the security and simplicity of credential management. Without SSO, users must manage different credentials for every service they use, which not only becomes cumbersome but also increases security risks. A common example of SSO in action is when you see an option like “Log in with your Google account.” One key benefit of SSO is that users only need to manage one strong password, which reduces the risk of reusing weak passwords or writing them down. What is OAuth? OAuth, on the other hand, is a protocol that allows Application A to access resources in Application B on behalf of the user—safely and with permission. For example, when a photo-sharing app (App A) requests permission to post photos to your Facebook account (App B), that’s OAuth in action. Importantly, the photo-sharing app never sees your Facebook login details—it can only perform the specific actions you’ve allowed. SSO vs. OAuth: What's the Difference? In short: SSO is for users to access multiple services with a single login. OAuth is for applications to securely get access to a user’s data or resources in another application. Authentication vs. Authorization At the heart of SAML authentication are two key concepts: authentication and authorization. Authentication Authentication is the process of verifying that "you are really who you say you are." Think of it like showing your ID in real life. In web services, this usually involves entering a username and password. Authorization Authorization is the process of determining whether "you have permission to do something." For example, on YouTube, only users who have paid for a subscription can watch videos without ads. That’s a form of authorization. The Difference Between Authentication and Authorization Authentication: “Are you really you?” (Identity verification) Authorization: “Do you have the right to do this?” (Permission check) So, What Is SAML Authentication? SAML authentication uses the SAML standard to safely exchange authentication and authorization data between different services. In this process, the IdP confirms the user's identity and securely sends the authentication result to the SP. SAML authentication is most often used in conjunction with SSO and typically consists of three main steps: Authentication request Authentication response Assertion exchange Since SAML uses digital signatures and encryption, it ensures the integrity and confidentiality of the authentication data. Key Terms in SAML Authentication and SSO Here are some important terms you'll encounter when working with SAML authentication and SSO, explained using a courier delivery analogy: IdP (Identity Provider): The system that authenticates users and manages their identity information. In an SSO setup, when a user tries to access a service, the IdP verifies their identity and sends confirmation to the SP. SP (Service Provider): The system that delivers services or applications to users. In the SSO context, it trusts the IdP’s authentication and grants access to the user. Assertion: Part of the SAML message that contains authentication and user attribute data. Think of it as the package being delivered, including the contents (auth info) and the shipping label (details about the authentication). Protocol: Defines the rules and procedures for exchanging information between the IdP and SP—like how messages are formatted and in what order they are exchanged. This is equivalent to the delivery process and handling rules in a courier service. Binding: Describes how SAML protocol messages are transmitted over a specific communication protocol (e.g., HTTP, SOAP). In our courier analogy, this would be the method of transport—truck, plane, or motorcycle—and how the label is attached to the package. Profile: Specifies how to combine assertions, protocols, and bindings for a specific use case. For example, using a web browser for SSO. In the courier analogy, this would be like a specific delivery service plan, such as express delivery or time-sl

Apr 4, 2025 - 11:45

Let's Start with SAML

SAML stands for Security Assertion Markup Language. It’s an XML-based standard that enables secure authentication and authorization between different systems. As I'll explain in detail later, SAML facilitates the exchange of authentication data between an Identity Provider (IdP) and a Service Provider (SP). Using SAML allows sensitive authentication data to be handled safely and enables secure Single Sign-On (SSO) authentication.

The Relationship Between SSO and OAuth

To truly understand SAML authentication, you need to be familiar with the concepts of Single Sign-On (SSO) and OAuth.

What is SSO?

SSO allows users to access multiple systems or applications securely with just one login. It eliminates the need to remember separate login credentials for each service, making the user experience more convenient and improving the security and simplicity of credential management.

Without SSO, users must manage different credentials for every service they use, which not only becomes cumbersome but also increases security risks. A common example of SSO in action is when you see an option like “Log in with your Google account.”

One key benefit of SSO is that users only need to manage one strong password, which reduces the risk of reusing weak passwords or writing them down.

What is OAuth?

OAuth, on the other hand, is a protocol that allows Application A to access resources in Application B on behalf of the user—safely and with permission. For example, when a photo-sharing app (App A) requests permission to post photos to your Facebook account (App B), that’s OAuth in action. Importantly, the photo-sharing app never sees your Facebook login details—it can only perform the specific actions you’ve allowed.

SSO vs. OAuth: What's the Difference?

In short:

SSO is for users to access multiple services with a single login.
OAuth is for applications to securely get access to a user’s data or resources in another application.

Authentication vs. Authorization

At the heart of SAML authentication are two key concepts: authentication and authorization.

Authentication

Authentication is the process of verifying that "you are really who you say you are." Think of it like showing your ID in real life. In web services, this usually involves entering a username and password.

Authorization

Authorization is the process of determining whether "you have permission to do something." For example, on YouTube, only users who have paid for a subscription can watch videos without ads. That’s a form of authorization.

The Difference Between Authentication and Authorization

Authentication: “Are you really you?” (Identity verification)
Authorization: “Do you have the right to do this?” (Permission check)

So, What Is SAML Authentication?

SAML authentication uses the SAML standard to safely exchange authentication and authorization data between different services. In this process, the IdP confirms the user's identity and securely sends the authentication result to the SP.

SAML authentication is most often used in conjunction with SSO and typically consists of three main steps:

Authentication request
Authentication response
Assertion exchange

Since SAML uses digital signatures and encryption, it ensures the integrity and confidentiality of the authentication data.

Key Terms in SAML Authentication and SSO

Here are some important terms you'll encounter when working with SAML authentication and SSO, explained using a courier delivery analogy:

IdP (Identity Provider): The system that authenticates users and manages their identity information. In an SSO setup, when a user tries to access a service, the IdP verifies their identity and sends confirmation to the SP.
SP (Service Provider): The system that delivers services or applications to users. In the SSO context, it trusts the IdP’s authentication and grants access to the user.
Assertion: Part of the SAML message that contains authentication and user attribute data. Think of it as the package being delivered, including the contents (auth info) and the shipping label (details about the authentication).
Protocol: Defines the rules and procedures for exchanging information between the IdP and SP—like how messages are formatted and in what order they are exchanged. This is equivalent to the delivery process and handling rules in a courier service.
Binding: Describes how SAML protocol messages are transmitted over a specific communication protocol (e.g., HTTP, SOAP). In our courier analogy, this would be the method of transport—truck, plane, or motorcycle—and how the label is attached to the package.
Profile: Specifies how to combine assertions, protocols, and bindings for a specific use case. For example, using a web browser for SSO. In the courier analogy, this would be like a specific delivery service plan, such as express delivery or time-slot delivery.

How SAML Authentication Works

SAML authentication involves cooperation between the IdP and SP:

The user tries to access a service (SP-initiated).
The service detects the user isn’t authenticated and redirects them to the IdP.
The IdP authenticates the user and returns the result as an assertion.
The SP validates the assertion, and if successful, grants the user access to the service.

Types of SAML Authentication

There are two main types of SAML authentication:

IdP-Initiated: The user first logs into the IdP, then selects a service (SP) from the IdP portal. This method is considered more secure.
SP-Initiated: The user starts by accessing the SP, which then redirects them to the IdP for authentication. This is the more common approach.

Why Is SAML Authentication Secure?

SAML authentication is considered secure for several reasons:

Signed and encrypted data: SAML responses (assertions) are digitally signed to ensure they haven’t been tampered with. Sensitive data can also be encrypted to protect it from eavesdropping.
Mutual trust: IdP and SP establish a trusted relationship and only accept data from trusted entities.
Single Sign-On (SSO): Reduces the risk of weak passwords and password reuse by minimizing the number of credentials a user needs to manage.
Secure communication channels: SAML transactions are conducted over HTTPS, protecting the confidentiality and integrity of the data in transit.

Among these, assertion signing (to prevent tampering) and HTTPS encryption (to secure communication) play a particularly vital role in ensuring security.

Conclusion

In this article, we explored what SAML authentication is all about—starting from its basic concepts, how it relates to SSO and OAuth, the distinction between authentication and authorization, how SAML authentication works, and why it’s considered secure.

SAML is a crucial technology in today’s cloud-first world, balancing security and convenience. Hopefully, this helped you gain a clearer understanding of what SAML authentication is and how it works.

References

SAML認証ってなんやねん