SAML: Security Assertion Markup Language Complete Guide

SAML enables secure single sign-on across enterprise applications. This guide covers implementation essentials.

How SAML Works

1. 1User accesses service provider
2. 2SP redirects to identity provider
3. 3User authenticates with IdP
4. 4IdP sends SAML assertion to SP
5. 5SP creates session for user

SAML Assertion

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
  <saml:Issuer>https://idp.example.com</saml:Issuer>
  <saml:Subject>
    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
      user@example.com
    </saml:NameID>
  </saml:Subject>
  <saml:AttributeStatement>
    <saml:Attribute Name="role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
      <saml:AttributeValue>admin</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
</saml:Assertion>

Implementation

Use libraries like Passport-SAML for Node.js to implement SAML SSO in your applications.

Best Practices

• Sign and encrypt assertions
• Validate all SAML responses
• Implement proper logout
• Monitor SAML transactions

Conclusion

SAML remains the standard for enterprise SSO. Implement carefully for secure federated identity.