SAML Authentication Explained: SSO, IdP and SP
Learn how SAML lets identity providers share trusted sign-in information with service providers so users can access cloud and web applications through single sign-on.
In This Lesson
Trace a SAML single sign-on exchange among the browser, service provider, and identity provider. You will learn what the assertion carries, where trust is established, and which validation checks prevent abuse.
Quick Learning Map
Keep this three-step view in mind as you work through the detailed lesson.
Start at the service
The service provider redirects an unauthenticated browser to the trusted identity provider.
Authenticate and assert
The identity provider verifies the user and returns a signed SAML assertion.
Validate and create a session
The service provider checks signature, audience, destination, and time before granting access.
SAML Authentication Explained: SSO, IdP and SP at a Glance
Use this summary to establish the big picture before moving into the detailed explanations, commands, and checks.
Core focus
Trace a SAML single sign-on exchange among the browser, service provider, and identity provider.
Key connection
Start at the service → Authenticate and assert → Validate and create a session
Practical outcome
You will learn what the assertion carries, where trust is established, and which validation checks prevent abuse.
How is SAML used for authentication?
SAML lets an identity provider authenticate a user and send a signed assertion to a service provider. The service provider validates that assertion and starts a session without receiving the user’s password. SAML is commonly used for browser-based enterprise single sign-on.
What Is SAML?
Security Assertion Markup Language, commonly called SAML and pronounced "SAM-el," is an XML-based open standard used to exchange authentication and authorization data between systems. It allows an identity provider to tell a service provider that a user has already been authenticated and may be allowed to access a specific application.
SAML is widely used for enterprise single sign-on. Instead of creating a separate password for every cloud service, users sign in through a trusted identity system and then access approved applications through a federated identity flow.
How SAML Enables Single Sign-On
Single sign-on reduces password fatigue and centralizes identity control. A user signs in once with the identity provider, and connected applications can rely on that identity instead of asking the user to create and manage separate credentials.
Users authenticate through a central identity provider and move between approved applications more smoothly.
Applications do not need to store separate passwords when SAML federation is configured correctly.
IT teams can enforce MFA, access policy, account lifecycle, and session rules from the identity platform.
How Does SAML Authentication Work?
SAML authentication works by passing a signed assertion between an identity provider and a service provider. The identity provider authenticates the user. The service provider consumes the assertion and decides whether to grant access.
Identity Provider (IdP)
The identity provider verifies the user. It may check a password, MFA challenge, device posture, conditional access rule, directory membership, or other identity signals. Examples include enterprise IAM platforms and SSO portals.
Service Provider (SP)
The service provider is the application or service the user wants to access. It relies on the identity provider's assertion instead of collecting the user's password directly.
SAML Example Flow
- A user opens a SaaS application, such as hosted email or a business dashboard.
- The service provider checks whether the user already has a valid session.
- If not, the service provider redirects the browser to the identity provider.
- The identity provider authenticates the user and applies access policy.
- The identity provider sends a signed SAML assertion back to the service provider.
- The service provider validates the assertion and grants access to the application.
A SAML assertion can include user identity, attributes, issue time, audience, validity conditions, and a digital signature. The exact fields depend on the application and identity configuration.
SAML Components
The SAML framework uses a few core building blocks. Knowing these terms makes SSO troubleshooting much easier.
| Component | Purpose | Why it matters |
|---|---|---|
| Assertions | Statements about the authenticated user and authorization context. | The service provider uses the assertion to decide whether access should be allowed. |
| Protocols | Define how SAML requests and responses are structured. | They let identity systems and applications exchange authentication messages consistently. |
| Bindings | Define how SAML messages are transported, often through browser redirects or POST requests. | Correct binding configuration prevents broken login flows. |
| Profiles | Combine assertions, protocols, and bindings for common use cases such as web browser SSO. | Profiles make SAML practical for repeatable enterprise deployments. |
What Is SAML 2.0?
SAML 2.0 is the widely used version of the standard for identity federation and single sign-on. It replaced earlier SAML versions and provides an XML framework for sending authentication and authorization data between the identity provider and service provider.
In practical enterprise environments, SAML 2.0 is commonly used to connect IAM platforms with SaaS applications, password-protected portals, partner services, and internal web applications.
SAML vs OAuth vs LDAP
SAML, OAuth, and LDAP all relate to identity, but they solve different problems and are used in different places.
| Technology | Primary role | Common use |
|---|---|---|
| SAML | Federated authentication and SSO. | Enterprise users signing into SaaS and web applications through an IdP. |
| OAuth | Delegated authorization with scoped access. | Allowing one application to access limited resources from another service. |
| LDAP | Directory access and authentication. | On-premises directory queries, user lookup, and internal authentication workflows. |
SAML vs OAuth
SAML is often better suited to enterprise SSO where the goal is to authenticate a workforce user into a business application. OAuth is more commonly used when an application needs limited access to another application's resources, such as account data or APIs.
SAML vs LDAP
LDAP is traditionally associated with directory services and on-premises authentication. SAML was designed for web and cloud application federation, making it more natural for browser-based SSO across SaaS applications.
Benefits of Using SAML
SAML helps organizations centralize identity decisions while improving the user experience. It is especially useful when teams need secure access to many cloud applications without creating isolated credentials everywhere.
Users sign in once and access approved apps without repeated password prompts.
Credential handling, MFA, and identity policy stay centralized in the identity provider.
SAML is an open standard and can work across many vendors and application stacks.
Centralized identity reduces duplicate account management across service providers.
Applications can trust assertions instead of storing every user's password locally.
Standards-based federation helps IAM teams connect different systems more predictably.
SAML Security Best Practices
- Use signed assertions: require the service provider to validate signatures from the trusted identity provider.
- Protect certificates: rotate signing certificates carefully and avoid expired metadata breaking SSO.
- Set strict audience and ACS values: assertions should be valid only for the intended service provider endpoint.
- Enforce MFA: apply MFA and conditional access at the identity provider for sensitive applications.
- Limit attributes: send only the user attributes the application truly needs.
- Monitor login behavior: review unusual sign-in patterns, impossible travel, failed attempts, and unexpected service provider access.
- Test account lifecycle: make sure disabled users lose application access promptly.
SAML FAQs
What does SAML stand for?
SAML stands for Security Assertion Markup Language.
Is SAML used for authentication or authorization?
SAML can carry both authentication and authorization information. In most SSO conversations, it is mainly discussed as an authentication federation standard.
What is a SAML assertion?
A SAML assertion is a trusted message from the identity provider that tells the service provider who the user is and whether the login context is valid.
What is the difference between IdP and SP?
The identity provider authenticates the user. The service provider is the application that relies on the identity provider's assertion to grant access.
Why do enterprises use SAML?
Enterprises use SAML to centralize identity policy, simplify access to SaaS applications, reduce password sprawl, support MFA, and improve account lifecycle control.
Is SAML still used?
Yes. SAML 2.0 remains common for enterprise SSO, especially for business applications and identity federation between organizations.
SAML Single Sign-On Authentication Explained: Tags and Keywords
SAML, Security Assertion Markup Language, SAML authentication, SAML SSO, SAML 2.0, identity provider, service provider, IdP, SP, SAML assertion, SAML binding, SAML profile, SAML vs OAuth, SAML vs LDAP, IAM, single sign-on, identity federation, zero trust access.