SAML -Security Assertion Markup Language
Introduction
SAML (Security Assertion Markup Language) works by enabling a user to authenticate once with an Identity Provider (IdP) and then use that authentication to access multiple Service Providers (SPs) without needing to re-enter credentials. Essentially, it's a standardized way for one system (the IdP) to vouch for a user's identity to another system (the SP).
How it works
Trust Relationship:
Before any communication, the IdP and SP establish a trust relationship by exchanging metadata, certificates, and other configuration details.
User Request:
A user attempts to access a resource on a Service Provider (SP)
Redirection to IdP:
The SP, recognizing the user is not authenticated, redirects the user to the IdP's login page.
Authentication at IdP:
The user authenticates with the IdP (e.g., using username/password, multi-factor authentication, etc.).
SAML Assertion:
Upon successful authentication, the IdP creates a SAML assertion, which is an XML document containing user information, authorization details, and a digital signature.
Assertion Delivery:
The IdP sends the SAML assertion back to the SP, usually through the user's browser using a POST request.
Verification and Authorization:
The SP verifies the SAML assertion's signature and extracts user information and authorization data.
Access Granted:
If the assertion is valid, the SP grants the user access to the requested resource or application.
Single Sign-On (SSO):
The SP can also use the SAML assertion to establish a session for the user, allowing them to access other applications within the same domain without needing to re-authenticate.
Key Components
Identity Provider (IdP): The system that authenticates the user (e.g., corporate directory, cloud identity provider).
Service Provider (SP): The application or service that relies on the IdP for user authentication (e.g., SaaS application, internal web application).
SAML Assertion: The XML document containing user information and authorization details.
Single Sign-On (SSO): The ability for users to access multiple applications with a single login.
