SAML (Security Assertion Markup Language) is an identity federation protocol used to implement enterprise single sign-on (SSO).

If you searched "what is SAML", the practical answer is: SAML lets an identity provider prove who a user is to another app without the app storing the user's password.

Core roles in SAML

  • Identity Provider (IdP): authenticates the user.
  • Service Provider (SP): trusts the IdP assertion and grants app access.
  • User agent: usually the browser carrying protocol messages.

How SAML authentication flow works

  1. User tries to access the SP.
  2. SP redirects user to IdP for authentication.
  3. IdP authenticates user (password, MFA, policy checks).
  4. IdP issues a signed SAML assertion.
  5. Browser posts assertion back to SP.
  6. SP validates signature, audience, and expiry.
  7. SP establishes authenticated session.

What is in a SAML assertion?

Typical assertion components:

  • subject (who the user is),
  • authentication statement (how/when user authenticated),
  • attributes (email, roles, groups),
  • conditions (audience, validity window).

Assertions must be signed and validated correctly. Misconfiguration creates high-impact auth risk.

Why enterprises still use SAML

  • strong support in enterprise IdPs and SaaS ecosystems,
  • mature policy and group-based provisioning workflows,
  • proven model for browser-based SSO.

SAML vs OAuth vs OIDC

ProtocolPrimary purpose
SAMLEnterprise authentication federation (often browser SSO)
OAuth 2.0Delegated authorization to APIs
OpenID Connect (OIDC)Authentication layer on OAuth 2.0

SAML is not "old and useless"; it is often the right choice in enterprise environments with existing IdP infrastructure.

Common SAML implementation mistakes

  • weak certificate lifecycle management,
  • clock skew causing assertion expiry issues,
  • missing audience/recipient validation,
  • role mapping drift between IdP and app permissions.

SAML rollout checklist

  1. Define required attributes and role mappings.
  2. Configure strict assertion validation (issuer, audience, timestamps).
  3. Enforce MFA policy at IdP for risky applications.
  4. Test SSO, SLO, and account lockout scenarios.
  5. Add break-glass admin access pattern.

Final take

SAML remains a core enterprise SSO protocol. Treat setup as a security integration project, not just a login convenience feature.