What it means
Security Assertion Markup Language (SAML) carries an assertion from an identity provider to a relying application. A common pattern is a signed authentication statement: this subject authenticated at this time, for this audience. The application checks the signature, the issuer, the recipient, and the validity window, then starts its own session. Attributes in the assertion can hint at a role. They are claims to evaluate, not a command the application must obey.
A valid assertion does not authorize every button in the portal. It does not survive as a blank pass for a second application, and it does not end local sessions when the identity provider later disables the account unless someone designed that. Single sign-on can use SAML. Federation is the trust relationship. Authorization remains the application’s decision about a named action.
AN ILLUSTRATIVE SCENARIO
The warehouse portal trusts one assertion
Priya signs in at Riverstone’s identity provider. The warehouse portal accepts a SAML response whose audience is that portal and opens a session. The portal still limits Priya to the Warehouse role: view docks, not export every TrackPort address. A copied assertion aimed at the payroll application fails the audience check. When Priya’s account is disabled, the team checks the portal session separately instead of assuming the assertion expires in every tab.
Put it to work
- Name the identity provider, the relying application, the audience, and which attributes the application will honor. List the actions the assertion must not grant.
- Validate signature, issuer, recipient, and time limits with a maintained library. Prefer the application’s own permission table over a raw group attribute.
- Test a valid sign-in, an assertion for another application, an expired assertion, and an account disable. Record whether existing sessions end.
How to check your work
Complete a test sign-in and confirm an unapproved export is denied. Replay an assertion minted for another audience and an expired assertion. Both must fail before a session starts.
Connect the ideas
- Federation
Trusting authentication assertions from an external identity provider instead of storing every password locally.
- SSO
A pattern where one authentication to an identity provider is reused across multiple applications.
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.