Catalog
concept#Security#Integration#Architecture#Platform

Security Assertion Markup Language (SAML)

XML-based standard for exchanging authentication and authorization assertions between identity providers and service providers.

SAML is an XML‑based open standard for exchanging authentication and authorization assertions between identity providers and service providers.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

Identity providers: ADFS, Okta, Keycloak, Auth0Service providers: web apps, API gateways, SaaS servicesUser directories: Active Directory, LDAP, HR systems

Principles & goals

Centralize authentication at a trusted identity provider.Minimize sensitive credentials stored at service providers.Explicit metadata and certificate management to ensure trust.
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Incorrect metadata or expired certificates lead to authentication outages.
  • Misconfigured attributes can result in over- or under-privileged access.
  • Insecure assertion processing at SP side can enable replay or tampering risks.
  • Automate metadata and certificate management.
  • Least-privilege attributes: transmit only necessary attributes.
  • Regularly test failover and rotation scenarios.

I/O & resources

  • Directory service with user and group attributes (e.g., AD/LDAP).
  • Identity provider with SAML support and valid certificates.
  • Service provider able to receive and process SAML assertions.
  • Securely transmitted assertions for authentication and authorization.
  • Central logs and audit entries for authentication activity.
  • Reduced number of local user logins on SPs.

Description

SAML is an XML‑based open standard for exchanging authentication and authorization assertions between identity providers and service providers. It enables single sign‑on (SSO) and federated identity across organizational boundaries, reducing password proliferation and centralizing access control. SAML specifies assertions, protocols and bindings for interoperable federation.

✔

  • Enables single sign-on and reduces password management.
  • Promotes interoperability between different systems and vendors.
  • Central control over attributes and access rules.

✖

  • XML-based and relatively complex to parse and debug.
  • Higher configuration overhead, especially for metadata and certificates.
  • Possible latency due to redirect/POST workflows in web scenarios.

  • Number of SSO logins per day

    Measures usage and load on IdP systems.

  • Assertion processing error rate

    Share of failed assertion validations among all requests.

  • Time to recovery after certificate rotation

    Time until all SPs accept assertions again.

University federation (Shibboleth)

Universities use SAML via Shibboleth for federated authentication across institutions.

Enterprise SSO with ADFS

Windows environments often use ADFS as identity provider to deliver SAML assertions.

SaaS integration via Okta

Okta is used as identity provider to enable SAML-based access to SaaS services.

1

Analyze existing authentication flows and attribute requirements.

2

Set up/harden an IdP and exchange metadata with SPs.

3

Configure assertions, mappings and test scenarios.

4

Monitor after go-live and introduce certificate rotation processes.

⚠️ Technical debt & bottlenecks

  • Legacy SPs using outdated SAML libraries that need updating.
  • Manual metadata maintenance without automation.
  • Missing central documentation of attribute mappings and policies.
Metadata managementCertificate rotationAttribute mapping
  • SP trusts unverified assertions from non-validated IdPs.
  • Transmitting sensitive attributes without proper encryption.
  • Configuring IdP as single point of failure without redundancy.
  • Namespace or encoding differences lead to validation errors.
  • Missing time synchronization between IdP and SPs.
  • Insufficient testing with external partners before production.
Knowledge of SAML protocols, XML-DSig and XML-Enc.Experience with identity provider configuration and metadata management.Familiarity with certificate management and PKI fundamentals.
Interoperability with external partners and SaaS providers.Central authentication and authorization policies.Secure key and certificate management for assertions.
  • • Dependency on IdP availability and scaling model.
  • • Need to correctly implement XML-DSig and XML-Enc.
  • • Compatibility checks between IdP and SP versions required.