SAML 2.0, IT Atlas

Overview

SAML remains the dominant enterprise SSO protocol for established SaaS applications. The identity provider signs an assertion containing the subject, attributes and conditions; the service provider validates the signature and creates a session.

Newer applications generally prefer OpenID Connect, which is JSON based and better suited to mobile and API scenarios, but SAML is entrenched and will remain in use for years.

Security considerations

Validate signatures, audience restriction, NotBefore/NotOnOrAfter and replay protection.
Monitor for new or modified federation trusts and rotate signing certificates on a schedule.

Related topics

Single Sign On

One authentication event, evaluated by a central identity provider, granting access to many applications through issued tokens or assertions.

OpenID Connect

An authentication layer on top of OAuth 2.0 that issues signed ID tokens describing who the user is.

Microsoft Entra ID

Microsoft's cloud identity and access management service, the identity control plane for Microsoft 365, Azure and thousands of federated applications.

OAuth 2.0

An authorization framework that lets an application obtain scoped, delegated access to an API on a user's behalf without handling their credentials.

Federation & External Identity

Trusting another organisation's identity provider so its users can access your resources without local accounts.