SAML

What it means

SAML, the Security Assertion Markup Language, is an XML standard for single sign-on. A company's identity provider proves who a person is, and your app, the service provider, accepts that proof. SAML 2.0 is the version in use. Most business customers expect it.

The proof is an assertion: an XML document saying who the person is and when and for whom it was issued, signed by the identity provider. The browser carries it from one side to the other. Your app must check the signature, the issuer, the audience and the time window before it trusts it.

Why it matters

Business customers often ask for SAML before they buy, so it is a sales feature as well as a security one. A mistake in your side of the integration is serious, because the sign-in decision is entirely in the assertion. If you accept a forged or altered one, an attacker gets into any account they choose.

SAML has a long record of parsing and signature problems, because XML signatures are complex. Most come from custom code or an old library, not from the standard itself. Using a maintained library and keeping it patched removes most of the risk.

How it shows up

You meet SAML in the enterprise tier of a product, set up by an administrator who pastes in a metadata file or certificate. Per customer, your app stores the identity provider's signing certificate and the entity IDs. Each tenant must be tied to its own provider.

Mistakes to check: the signature is verified on part of the document but the app reads a different part, signature checks that can be skipped by removing them, no check of the audience or expiry, assertions that can be replayed, and one tenant's assertion accepted for another. See [[saml-signature-wrapping]] for the first of these.