(Pronounced “sam-el”) SAML, short for Security Assertion Markup Language,) is an open standard that uses Extensible Markup Language (XML) to secure and otherwise manage the communication and verification of credentials between web service providers and identity managers. SAML defines mechanisms to exchange authentication, authorization, and nonrepudiation information, allowing single sign-on (SSO) capabilities for web services.
In password authentication, the goal is to ensure users are authenticated and authorized to use certain web services by the overarching identity manager. And as web applications continue to grow in their popularity, SAML will continue to be essential in addressing the need for secure logins. Learn more about SAML and how it works in this definition.
Portions of this definition originally appeared on eSecurity Planet and are excerpted here with permission.
In this definition...
What Are Service Providers and Identity Managers?
Service providers are organizations and web services requested by users; these providers have been authorized according to backend databases and protocols established by software developers.
Identity managers create systems in which credentials merge to become a federated identity for a specific user to access applications. As a result, identity managers control which users can access what data through network user identity management.
Service providers and identity managers are key players in SAML processes that manage transactions for federated networks.
How Does SAML Work?
SAML splits the responsibilities of the authentication and authorization process, which helps to simplify the communication between web service providers and identity managers. During the process:
- A user logs into the identity manager’s single sign-on (SSO).
- The user submits a request for a privileged web page.
- The service provider confirms user credentials with the identity provider.
- The identity provider validates the user.
- The user accesses the requested web page.
What Is the Difference Between OAuth and SAML?
While both SAML and OAuth offer a way for web service providers and users to communicate, they address different sides of the authorization-authentication coin. Where SAML is a standard for identity management and federation, OAuth is a pure authorization protocol that pairs with authentication protocols like OpenID Connect (OIDC) and newer protocols designed for mobile and web applications.
In addition, OAuth works primarily with JSON Web Tokens (JWTs), which are more lightweight and self-contained compared to the XML used by SAML. They also include digital signatures for independent verification.
Read next: Best Identity and Access Management (IAM) Solutions
