SAML (Security Assertion Markup Language)

(Pronounced “sam-el”) SAML, short for Security Assertion Markup Language,) is an open standard that uses Extensible Markup Language (XML) to secure and otherwise manage the communication and verification of credentials between web service providers and identity managers. SAML defines mechanisms to exchange authentication, authorization, and nonrepudiation information, allowing single sign-on (SSO) capabilities for web services.

In password authentication, the goal is to ensure users are authenticated and authorized to use certain web services by the overarching identity manager. And as web applications continue to grow in their popularity, SAML will continue to be essential in addressing the need for secure logins. Learn more about SAML and how it works in this definition.

Portions of this definition originally appeared on eSecurity Planet and are excerpted here with permission.

What Are Service Providers and Identity Managers?

Service providers are organizations and web services requested by users; these providers have been authorized according to backend databases and protocols established by software developers

Identity managers create systems in which credentials merge to become a federated identity for a specific user to access applications. As a result, identity managers control which users can access what data through network user identity management.

Service providers and identity managers are key players in SAML processes that manage transactions for federated networks.

How Does SAML Work?

SAML splits the responsibilities of the authentication and authorization process, which helps to simplify the communication between web service providers and identity managers. During the process:

  1. A user logs into the identity manager’s single sign-on (SSO).
  2. The user submits a request for a privileged web page.
  3. The service provider confirms user credentials with the identity provider.
  4. The identity provider validates the user.
  5. The user accesses the requested web page.

What Is the Difference Between OAuth and SAML?

While both SAML and OAuth offer a way for web service providers and users to communicate, they address different sides of the authorization-authentication coin. Where SAML is a standard for identity management and federation, OAuth is a pure authorization protocol that pairs with authentication protocols like OpenID Connect (OIDC) and newer protocols designed for mobile and web applications.

In addition, OAuth works primarily with JSON Web Tokens (JWTs), which are more lightweight and self-contained compared to the XML used by SAML. They also include digital signatures for independent verification.

Read next: Best Identity and Access Management (IAM) Solutions

Sam Ingalls
Sam Ingalls
Sam Ingalls is an award-winning writer and researcher covering enterprise technology, cybersecurity, data centers, and IT trends, for eSecurity Planet, TechRepublic, ServerWatch, Webopedia, and Channel Insider.

Related Articles


What is phishing? Phishing is a type of cybercrime in which victims are contacted by email, telephone, or text message by an attacker posing as...

Photo Editing Software

Photo editing software is used to manipulate or enhance digital images. This category of software ranges from basic apps, which are able to apply...

SOHO Business Solutions: Free Email Marketing Services

Just like big businesses, SOHO (small office/home office) owners can leverage email marketing systems to communicate with customers, partners and employees. Just like big businesses,...


Fintech, also known as "financial technology," is a term used to describe companies that use innovative technology to create more efficient, transparent, and cost-effective...


ScalaHosting is a leading managed hosting provider that offers secure, scalable, and affordable...


Human resources information system (HRIS) solutions help businesses manage multiple facets of their...

Best Managed Service Providers...

In today's business world, managed services are more critical than ever. They can...