Security Assertion Markup Language (SAML)

Overview

Security Assertion Markup Language is an XML-based standard for exchanging authentication, attribute, and authorization information between an identity provider and a service provider, commonly for enterprise single sign-on.

Security Assertion Markup Language (SAML) is closely connected to Policy-Based Access Control (PBAC), Passwordless Authentication, and Mandatory Access Control (MAC). SAML carries signed assertions and protocol messages; it is not an authentication method by itself and does not guarantee security if metadata, certificates, audience restrictions, bindings, or assertion validation are implemented incorrectly.

Operational implementation should validate signatures and trust anchors, restrict issuer and audience, enforce time and replay conditions, protect metadata changes, use secure bindings, map attributes minimally, log federation events, and plan certificate rotation.

The principal failure modes include unsigned or incorrectly validated assertions, XML signature wrapping, replay, stale metadata, broad attributes, account mapping errors, open redirects, and outage during certificate rollover.

Useful measures include federation login success, assertion validation failures, replay detections, certificate age, metadata changes, and unauthorized account-mapping incidents.

Operationally, teams should validate signatures and trust anchors, restrict issuer and audience, enforce time and replay conditions, and protect metadata changes. Key risks include unsigned or incorrectly validated assertions, XML signature wrapping, replay, and stale metadata.

Implementation of Security Assertion Markup Language (SAML) should map an XML-based standard for exchanging authentication, attribute, and authorization information between an identity provider and a service provider, commonly for enterprise single sign-on to the applicable entity, product, customer, transaction, and jurisdictional scope. Evidence for XML-based standard for exchanging authentication, attribute, and commonly for enterprise single sign-on should preserve the governing requirement, policy version, control execution, exception decision, owner, and review date. Material changes affecting the Security Assertion Markup context and XML-based standard for exchanging authentication, attribute, and commonly for enterprise single sign-on should trigger reassessment instead of silent reuse of an outdated conclusion.