SAML (Security Assertion Markup Language)

(Pronounced “sam-el”) SAML, short for Security Assertion Markup Language,) is an open standard that uses Extensible Markup Language (XML) to secure and otherwise manage the communication and verification of credentials between web service providers and identity managers. SAML defines mechanisms to exchange authentication, authorization, and nonrepudiation information, allowing single sign-on (SSO) capabilities for web services.

In password authentication, the goal is to ensure users are authenticated and authorized to use certain web services by the overarching identity manager. And as web applications continue to grow in their popularity, SAML will continue to be essential in addressing the need for secure logins. Learn more about SAML and how it works in this definition.

Portions of this definition originally appeared on eSecurity Planet and are excerpted here with permission.

What Are Service Providers and Identity Managers?

Service providers are organizations and web services requested by users; these providers have been authorized according to backend databases and protocols established by software developers

Identity managers create systems in which credentials merge to become a federated identity for a specific user to access applications. As a result, identity managers control which users can access what data through network user identity management.

Service providers and identity managers are key players in SAML processes that manage transactions for federated networks.

How Does SAML Work?

SAML splits the responsibilities of the authentication and authorization process, which helps to simplify the communication between web service providers and identity managers. During the process:

  1. A user logs into the identity manager’s single sign-on (SSO).
  2. The user submits a request for a privileged web page.
  3. The service provider confirms user credentials with the identity provider.
  4. The identity provider validates the user.
  5. The user accesses the requested web page.

What Is the Difference Between OAuth and SAML?

While both SAML and OAuth offer a way for web service providers and users to communicate, they address different sides of the authorization-authentication coin. Where SAML is a standard for identity management and federation, OAuth is a pure authorization protocol that pairs with authentication protocols like OpenID Connect (OIDC) and newer protocols designed for mobile and web applications.

In addition, OAuth works primarily with JSON Web Tokens (JWTs), which are more lightweight and self-contained compared to the XML used by SAML. They also include digital signatures for independent verification.

Read next: Best Identity and Access Management (IAM) Solutions

Sam Ingalls
Sam Ingalls
Sam Ingalls is an award-winning writer and researcher covering enterprise technology, cybersecurity, data centers, and IT trends, for eSecurity Planet, TechRepublic, ServerWatch, Webopedia, and Channel Insider.
Get the Free Newsletter
Subscribe to Daily Tech Insider for top news, trends & analysis
This email address is invalid.
Get the Free Newsletter
Subscribe to Daily Tech Insider for top news, trends & analysis
This email address is invalid.

Related Articles

Virtual Private Network (VPN)

A virtual private network (VPN) encrypts a device's Internet access through a secure server. It is most frequently used for remote employees accessing a...

Gantt Chart

A Gantt chart is a type of bar chart that illustrates a project schedule and shows the dependency between tasks and the current schedule...

Input Sanitization

Input sanitization is a cybersecurity measure of checking, cleaning, and filtering data inputs from users, APIs, and web services of any unwanted characters and...

IT Asset Management Software

IT asset management software (ITAM software) is an application for organizing, recording, and tracking all of an organization s hardware and software assets throughout...


ScalaHosting is a leading managed hosting provider that offers secure, scalable, and affordable...


Human resources information system (HRIS) solutions help businesses manage multiple facets of their...

Best Managed Service Providers...

In today's business world, managed services are more critical than ever. They can...