What is SAML?
Security Assertion Markup Language (SAML) is an open standard federation protocol.
- SAML was introduced in 2001
- SAML 2.0 superseded SAML in 2005
SAML protocol is used for authentication (AUTHN), and authorization (AUTHZ), and is often used for SSO (Single Sign-on) to web-based applications.
The SAML specification defines three entities or roles:
- The principal : typically a human user or USER Agent, such as a user’s internet browser
- Identify Provider (IdP)
- Service Provider (SP) : application or service your trying to access
A SAML federation is established (trust relationship) between the SP and IdP for SAML to work.
How SAML works
- User request access to SP
- SP must first authenticates with IdP
- Once user is successfully authenticated, Idp generates a SAML assertion
- The SAML assertion is then sent to the SP (trusted)
- Based on SAML assertion, SP makes a access control decision to decide to perform the service for the user.
- Since SP trusts the IdP, it will validates the assertion.
- Once SP authenticated to IdP, can SSO to other applications.
SAML flow:
- The IdP knows about your users and their attributes. The SP has its own knowledge about the users.
- When IdP generates an assertion, it populates with a user identifier (UID), and sends over to SP.
- IdP signs the assertion, so SP can verify the issuer of the assertion (trusted party)
- If successful, SP will read the UID and attempt to map session to the user in it’s inventory.
- IDP and SP meta data (XML file) exchange establishes the trust or federation
- The meta is contained in the XML (settings, configurations, and certificate of system)
- IdP dictates UID and SP must agree so SAML assertion can be mapped to user object at SP
- For example if email address is used as user id, SP and IdP must be configured to match to allow access.
SAML initiation flow:
There are two primary initiation SAML flows:
- IDP-Initiated flow.
- User starts by accessing the IDP
- IDP prompt’s user for authentication via User Agent to request service
- If authorized, IDP creates SAML assertion
- Using user agent > assertion is sent to SP via Post message (transport mechanism)
- SP verifies the SAML assertion and maps it to a user in its inventory
- SP than starts the session
- SP-Initiated flow
- User starts by reaching out to SP
- SP will redirect to User Agent for authentication against IDP (Request for authentication)
- Once validated, IDP will generate assertion
- IDP sends assertion to SP (IDP > User Agent > SP)
- SP than starts the session
testest test