Cybersecurity glossary
What is SAML (Security Assertion Markup Language)?
Learn what SAML is, how Security Assertion Markup Language enables federated SSO with assertions between identity and service providers, and which misconfigurations cause account takeover risk.
Definition
SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorization assertions between an identity provider and a service provider, commonly used to implement enterprise single sign-on.
Why SAML matters
Enterprises need employees to reach many SaaS apps without separate passwords for each. SAML (Security Assertion Markup Language) became a dominant standard for that federation: an identity provider authenticates the user once, then issues signed XML assertions that service providers trust for SSO.
SAML still powers countless workforce integrations. It also carries XML-era risks—signature validation mistakes and parser issues—that identity teams must treat as security-critical code.
Core SAML roles
Identity Provider (IdP)
Authenticates users and issues SAML assertions (for example, corporate IdP).
Service Provider (SP)
The application that consumes assertions and creates local sessions.
Assertions
Signed XML statements of identity, authentication context, and attributes.
Metadata
Endpoints and certificates exchanged so IdP and SP can trust each other.
Typical SP-initiated SSO flow
User opens the application
The SP detects no session and starts a SAML authentication request.
Redirect to the IdP
The browser is sent to the IdP with an AuthnRequest.
User authenticates
Password, MFA, or other IdP policies verify the user.
IdP returns an assertion
A Response with a signed assertion is posted to the SP Assertion Consumer Service.
SP validates the assertion
Signature, audience, destination, timing, and subject checks must pass.
Application session starts
The SP issues its own session cookie or token for subsequent requests.
Security essentials
| Control | Why it matters |
|---|---|
| Validate XML signatures correctly | Prevents forged or wrapped assertions from being accepted |
| Hardened XML parsing | Reduces XXE and billion-laughs risks in SAML XML |
| Audience and destination checks | Stops assertions issued for one SP from being reused at another |
| Certificate lifecycle | Expired/wrong IdP signing keys cause outages or trust failures |
| TLS everywhere | Protects SAML messages and login flows in transit |
- Use maintained SAML libraries; do not hand-parse assertions.
- Require signed assertions/responses per your threat model; reject unsigned ones.
- Disable external entity resolution in XML parsers handling SAML.
- Pin expected IdP entity IDs, ACS URLs, and certificate fingerprints carefully.
- Prefer short assertion lifetimes and strict clock skew tolerances.
- Enforce MFA at the IdP for sensitive applications.
- Monitor SSO failures and unexpected certificate changes.
- Document SP metadata ownership so renewals do not break production silently.
The practical takeaway
SAML exchanges signed XML assertions so identity providers can SSO users into service providers. It remains foundational enterprise federation technology alongside newer OIDC deployments.
Treat assertion validation and XML parsing as high-risk code paths. Correct signatures, audiences, and parser hardening decide whether SAML is a convenience—or an account takeover protocol.
Related security terms
Single Sign-On (SSO)
The broader login pattern SAML frequently implements in enterprises.
OpenID Connect (OIDC)
A modern JSON/OAuth-based alternative commonly used for newer app SSO.
OAuth 2.0
A delegated authorization framework that OIDC builds on, distinct from SAML.
XML External Entity (XXE) Injection
A risk class relevant because SAML messages are XML.
Frequently asked questions
What is SAML in simple terms?
SAML is a way for one system (your company login) to tell another system (a SaaS app) that you are already authenticated, using signed XML messages called assertions.
What are IdP and SP in SAML?
The Identity Provider (IdP) authenticates users. The Service Provider (SP) trusts assertions from the IdP and grants access to the application.
Is SAML the same as OAuth or OIDC?
No. SAML is an XML federation protocol for SSO assertions. OAuth authorizes API access; OIDC adds modern authentication on OAuth using JWT ID tokens.
What is a SAML assertion?
An assertion is a signed XML statement from the IdP about the user’s identity and authentication context, sometimes including attributes and authorization data.
What are common SAML vulnerabilities?
Signature wrapping, XXE in XML parsers, weak certificate validation, open redirect ACS URLs, and accepting unsigned or wrongly signed assertions.
When should organizations use SAML vs OIDC?
Many enterprises still require SAML for mature SaaS integrations. New greenfield apps often prefer OIDC, but the choice follows IdP and application support.
Does SAML encrypt assertions?
Assertions can be signed and optionally encrypted. Signing is critical for integrity; encryption protects confidentiality of attributes in transit/at rest in the message.
References
Explore authoritative guidance and frameworks related to saml (security assertion markup language).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.