The reference desk / In practice

SAML

An XML assertion from an identity provider to a relying application. A signed authentication statement says the provider authenticated the subject. It does not, by itself, authorize every function in the application.

Security Assertion Markup Language

What it means

Security Assertion Markup Language (SAML) carries an assertion from an identity provider to a relying application. A common pattern is a signed authentication statement: this subject authenticated at this time, for this audience. The application checks the signature, the issuer, the recipient, and the validity window, then starts its own session. Attributes in the assertion can hint at a role. They are claims to evaluate, not a command the application must obey.

A valid assertion does not authorize every button in the portal. It does not survive as a blank pass for a second application, and it does not end local sessions when the identity provider later disables the account unless someone designed that. Single sign-on can use SAML. Federation is the trust relationship. Authorization remains the application’s decision about a named action.

AN ILLUSTRATIVE SCENARIO

The warehouse portal trusts one assertion

Priya signs in at Riverstone’s identity provider. The warehouse portal accepts a SAML response whose audience is that portal and opens a session. The portal still limits Priya to the Warehouse role: view docks, not export every TrackPort address. A copied assertion aimed at the payroll application fails the audience check. When Priya’s account is disabled, the team checks the portal session separately instead of assuming the assertion expires in every tab.

Put it to work

  1. Name the identity provider, the relying application, the audience, and which attributes the application will honor. List the actions the assertion must not grant.
  2. Validate signature, issuer, recipient, and time limits with a maintained library. Prefer the application’s own permission table over a raw group attribute.
  3. Test a valid sign-in, an assertion for another application, an expired assertion, and an account disable. Record whether existing sessions end.

How to check your work

Complete a test sign-in and confirm an unapproved export is denied. Replay an assertion minted for another audience and an expired assertion. Both must fail before a session starts.

Connect the ideas

  • Federation

    Trusting authentication assertions from an external identity provider instead of storing every password locally.

  • SSO

    A pattern where one authentication to an identity provider is reused across multiple applications.

  • Authentication

    The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.

  • Authorization

    The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.

Explore a field lesson

Find your next idea.

Tip: press / to open search. Escape closes this window.