Understand how SAML enables Single Sign-On (SSO) for enterprises by allowing users to authenticate through a centralized identity provider (IdP).

---

Table of Contents

1. What is SAML?
2. How SAML Works
3. SAML vs OIDC
4. Benefits of SAML
5. SAML Assertions Explained
6. Implementing SAML SSO
7. Security Considerations
8. Troubleshooting
9. Glossary

---

What is SAML?

SAML (Security Assertion Markup Language) is an XML-based open standard used for Single Sign-On (SSO) across multiple domains. It allows users to log in once using a central Identity Provider (IdP) and gain access to multiple applications (Service Providers or SPs) without re-entering credentials.

• Developed by the OASIS consortium
• Commonly used in enterprise environments
• Compatible with IdPs like Okta, Azure AD, OneLogin, and more

---

How SAML Works

1. User tries to access a protected resource (Service Provider).
2. SP redirects the user to the Identity Provider (IdP).
3. User authenticates at the IdP (e.g. with corporate credentials).
4. IdP sends a SAML Response, containing an assertion, back to the SP.
5. SP validates the response, extracts identity data, and logs the user in.

---

SAML vs OIDC

Feature	SAML	OpenID Connect (OIDC)
Protocol Type	XML	JSON + REST (OAuth 2.0)
Popular Use Case	Enterprise SSO	Web/mobile app login
Transport Mechanism	Browser redirects (POST/Redirect)	JSON over HTTPS
Token Type	SAML Assertion (XML)	ID Token (JWT)
Complexity	Higher	Lower
Modern Usage	Decreasing	Increasing

✅ Use SAML for enterprise SSO, OIDC for modern apps and APIs.

---

Benefits of SAML

• SSO across applications using one login
• Reduced password fatigue and risk of credential reuse
• Centralized user management via corporate IdP
• Supports MFA and strong authentication policies
• Enterprise-grade compatibility with HR systems and internal apps

---

SAML Assertions Explained

A SAML Assertion is an XML document issued by the IdP containing identity and authorization data. It’s digitally signed and optionally encrypted.

Common Assertion Elements:

• <Subject> – The user being authenticated
• <AttributeStatement> – User info (e.g., email, role)
• <Conditions> – Expiration time, audience restrictions
• <AuthnStatement> – Details about the login (e.g., timestamp)

Example (simplified):

<saml:Assertion>
  <saml:Subject>
    <saml:NameID>jane@esadax.com</saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="email">
      <saml:AttributeValue>jane@esadax.com</saml:AttributeValue>
    </saml:Attribute>
    <saml:Attribute Name="role">
      <saml:AttributeValue>admin</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
</saml:Assertion>

---

Implementing SAML SSO

1. Register your app with the Identity Provider (IdP).

2. Configure Metadata Exchange:

   • App provides SAML Service Provider (SP) metadata.
   • IdP shares IdP metadata (certificates, endpoints).

3. Configure Assertion Consumer Service (ACS):

   • This is your app's endpoint to receive SAML responses.

4. Handle the SAML Response:

   • Validate signature and parse attributes.
   • Create a session based on assertion data.

---

Security Considerations

• ✅ Always validate the digital signature of the SAML response
• 🔐 Use HTTPS to prevent assertion interception
• 🧭 Validate audience to ensure the token is for your app
• ⌛ Check expiration times (NotBefore, NotOnOrAfter)
• 🚫 Reject unsigned or tampered assertions

---

Troubleshooting

• Invalid Signature?

  • Check if you're using the correct IdP certificate

• SAML Response Not Parsed?

  • Ensure correct encoding (Base64), and valid XML structure

• Incorrect Audience?

  • Ensure your SP entity ID matches what’s configured in IdP

• User Not Found?

  • Check if attribute mapping is correct (e.g., email, nameID)

---

Glossary

• SAML: Security Assertion Markup Language
• SSO: Single Sign-On
• IdP: Identity Provider (authenticates the user)
• SP: Service Provider (your app)
• ACS: Assertion Consumer Service – endpoint that handles SAML responses
• Assertion: The identity payload issued by the IdP
• Metadata: XML file describing SP/IdP capabilities and endpoints

---