SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization information. SAML 2.0 is widely used for single sign-on between an Identity Provider (IdP) and Service Provider (SP). The IdP authenticates the user; the SP trusts a signed assertion and creates a local session.
Roles and messages
| Element | Purpose |
|---|---|
| Identity Provider | Authenticates users and issues signed assertions. |
| Service Provider | Runs the target application and validates the response. |
| AuthnRequest | SP request to the IdP, often containing a request ID and return target. |
| Response/Assertion | XML with identity, conditions, audience and optional attributes. |
| Metadata | Describes endpoints, entity IDs, roles and trusted certificates. |
Simplified assertion
<saml:Assertion ID="_a123">
<saml:Issuer>https://idp.example.test</saml:Issuer>
<ds:Signature>...</ds:Signature>
<saml:Subject>
<saml:NameID>alice@example.test</saml:NameID>
</saml:Subject>
<saml:Conditions NotBefore="..." NotOnOrAfter="...">
<saml:AudienceRestriction>
<saml:Audience>https://app.example.test</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
</saml:Assertion>What must an SP validate?
- Signature:
Using an explicitly trusted certificate and allowed algorithm over the exact consumed element. - Issuer and audience:
The response comes from the expected IdP and targets this SP. - Recipient and destination:
Values point to the actual Assertion Consumer Service. - Time:
Validate NotBefore/NotOnOrAfter with small defined skew. - Request binding:
InResponseTo matches an outstanding, unused request. - Replay:
Accept response and assertion IDs only once until expiry.
Common weaknesses
Typical problems include missing signature validation, trusting a certificate supplied by the message, open RelayState redirects, replay, broad time windows and unsafe attribute mapping. XML Signature Wrapping validates one node while consuming another. Because SAML is XML, parser protection against XXE also matters.
SAML versus OAuth/OIDC
SAML focuses on XML-based enterprise browser SSO. OAuth 2.0 delegates resource access; OpenID Connect adds identity with JSON Web Tokens. They can coexist but are not interchangeable. See OAuth 2.0 and OpenID Connect.
Useful open-source tools
SAML Raider decodes, edits and tests SAML messages in authorized assessments. OWASP ZAP traces redirects, cookies and POST bindings. Integration tests remain essential because a scanner does not know the expected audience or correct attribute mapping.
Thank you for your feedback! We will review it and optimize this content.
Do you have feedback on SAML? Tell us!
Additional Services
Comprehensive IT security solutions for complete protection
Red Teaming
Simulation of real attacks on your company including people, infrastructure and processes. A comprehensive approach to testing your entire security strategy.
Learn more
Phishing Exercises
Practical phishing simulations to raise employee awareness. Increase awareness and reduce the risk of successful email-based attacks.
Learn more