SAML
acronymsecuritynetworking
Stands for: Security Assertion Markup Language
An XML standard for exchanging authentication between identity providers and services.
Security Assertion Markup Language (OASIS) lets an identity provider vouch for a user to a service via signed XML assertions, the backbone of much enterprise single sign-on. JWT-based OIDC is the more modern alternative.
SAML is what enterprise single sign-on ran on before the OAuth family arrived, and it is still what a great deal of it runs on today. The shape is worth holding in your head: the user hits an application, the application redirects to the identity provider, the user authenticates there, and the identity provider sends back a signed XML assertion saying who this is and what they are entitled to.
Debugging it means reading that assertion, which is base64-encoded and often compressed, so the first step is always to decode it into something human-readable. Once decoded, most failures are mundane and specific: the audience does not match, the assertion has expired, the clocks disagree between the two systems, the signature does not validate against the certificate the service provider has on file, or the attribute the application needs is not being sent under the name it expects.
Its longevity is often mistaken for stagnation. SAML persists because it does what enterprises need, integrates with everything, and has no compelling reason to be replaced in deployments that already work, which is a useful reminder that in infrastructure, boring and installed usually beats new and better.
Also known as: saml