assertion

security

The signed statement a federation protocol carries: who authenticated, when, how, for which audience, and for how long it is valid.

Every field in it is load-bearing. The audience stops a token issued for one service being replayed at another; the validity window limits how long a stolen one is useful; the authentication method tells the service whether a second factor was actually used. Services that check the signature and ignore the rest accept assertions that were technically valid and not meant for them.

Also known as: saml assertion

← All glossary entries