Skip to main content

← Back to glossary

Term · 8. Connectors & Integration

SAML SAML

SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). It enables web single sign-on: users authenticate once at the IdP and reach multiple applications without re-entering credentials. SAML 2.0 remains widely used for enterprise and B2B federation, though OIDC is now preferred for new APIs and mobile.

Protocol Source: OASIS SAML 2.0
AuthN Standards NIST OWASP

Definition

Security Assertion Markup Language 2.0 (OASIS standard, 2005). XML-based federation protocol — IdP issues signed SAML assertions to Relying Parties (Service Providers). Foundation of enterprise SSO for 20+ years. Browser-based redirect flow with form-POST binding. Increasingly replaced by OIDC for cloud-native apps but still required for many enterprise SaaS.

Synonyms
  • SAML
Application
Implementations: every major IdP, every enterprise SaaS app (Salesforce, Workday, ServiceNow, Box, etc.). Common attacks: XML signature wrapping, replay (without proper validation), assertion theft.
Standards & regulations
  • OASIS Standard: Security Assertion Markup Language (SAML) V2.0 «The OASIS Security Assertion Markup Language (SAML) V2.0 standard defines the syntax and semantics for XML-encoded assertions about authentication, attributes, and authorization, and for the protocols»
  • OASIS Standard: Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0 (saml-core-2.0-os) «This specification defines the OASIS Security Assertion Markup Language (SAML) V2.0. It specifies the structure and content of SAML assertions and the protocol for requesting and returning them.[8]»
  • OASIS Standard: Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0 (saml-bindings-2.0-os) «This specification defines a set of SAML protocol bindings, including the HTTP Redirect, HTTP POST, and HTTP Artifact bindings, for transporting SAML protocol messages.[5]»
  • OASIS Standard: Profiles for the OASIS Security Assertion Markup Language (SAML) V2.0 (saml-profiles-2.0-os) «This specification defines profiles of the OASIS Security Assertion Markup Language (SAML) V2.0 for common use cases, including Web Browser SSO, single logout, artifact resolution, name identifier man»
  • OASIS Standard: Security Assertion Markup Language (SAML) V2.0 Technical Overview «The OASIS Security Assertion Markup Language (SAML) standard defines an XML-based framework for describing and exchanging security information between on-line business partners.[7]»
  • OASIS Security Services (SAML) Technical Committee charter «The Security Assertion Markup Language (SAML), developed by the Security Services Technical Committee of OASIS, is an XML-based framework for communicating user authentication, entitlement, and attrib»
Sources

Related terms

← Back to glossary  ·  Open in main list

FAQ

Frequently asked questions

What is SAML used for?

SAML is mainly used for enterprise web single sign-on and federation — letting employees or partners log in once and reach many SaaS and internal apps. It carries signed XML assertions about a user's identity and attributes from the identity provider to each application.

SAML vs OAuth/OIDC — what is the difference?

SAML handles authentication and SSO using XML and is entrenched in enterprise apps. OAuth 2.0 handles delegated authorization, and OpenID Connect adds authentication on top using JSON/REST. New web, mobile and API projects usually choose OIDC; SAML persists where existing enterprise SaaS supports it.

Is SAML still relevant in 2026?

Yes. Most enterprise SaaS still offers SAML for SSO, and it remains a mature, safe choice for browser-based federation. For new APIs, mobile apps and consumer scenarios OIDC is generally the better fit — many platforms support both.