How does SAML work? IdP’s & SP’s
If you’re doing research on protocols that enable single sign-on, a typical question is, “How does SAML work?”
SAML, or Security Assertion Markup Language, is an entrenched SSO protocol and is a valuable standard to understand in order to fully comprehend how single sign-on works.
SAML allows organization to securely exchange attributes about people. A scenario that might sounds familiar would be signing into an active directory account to log on to your work computer in the morning, and automatically gaining access to your company gmail or salesforce.
The three main components of the SAML protocol:
- Assertions – Most common are the following 2 SAML assertions:
- Authentication assertions are used to make people prove their identities.
- Attribute assertions are used to generate specific information about the person, for example their phone number or email address.
- Protocol – This defines the way that SAML asks for and gets assertions, for example, using SOAP over HTTP.
- Binding – This details exactly how SAML message exchanges are mapped into SOAP exchanges.
5 Benefits of using a SAML IdP:
There are many reasons to use a SAML IdP. Besides being the dominant single sign on protocol in use today, here are 5 additional reasons to use SAML for SSO:
1. User passwords never cross the ﬁrewall, since user authentication occurs inside of the ﬁrewall and multiple Web application passwords are no longer required.
2. Web applications with no passwords are virtually impossible to hack, as the user must authenticate against an enterprise-class IdM ﬁrst, which can include strong authentication mechanisms.
3. “SP-initiated” SAML SSO provides access to Web apps for users outside of the ﬁrewall. If an outside user requests access to a Web application, the SP can automatically redirect the user to an authentication portal located at the Identity Provider. After authenticating, the user is granted access to the application, while their login and password remains locked safely inside the ﬁrewall.
4. Centralized federation provides a single point of Web application access, control and auditing, which has security, risk and compliance beneﬁts.
5. A properly executed identity federation layer that satisﬁes all of the use cases described above and supports multiple protocols can provide an enterprise-wide, architecturally sound Internet SSO solution.
For more on the SAML protocol, visit the blog, SAML Protocol Overview.