SAML enables single sing-on (SSO), which means that a user can authenticate once with an identity provider and then access multiple service providers without needing to authenticate again. This can simplify the user experience and improve security by reducing the number of credentials that need to be managed.
SAML assertions, pieces of data exchanged during authentication, contain information about a user’s identity, authentication status, and authorized access rights, among other things. Assertions are digitally signed to ensure their integrity and can be encrypted to protect their confidentiality.
TIP: You can use SAML-tracer extension for Firefox/Chrome to look at SAML authentication requests and responses. Log in to inet.muni.cz – it’s currently configured to not encrypt any SAML data.
Technically, IdPs and SPs must run the necessary software (e.g. Shibboleth or SimpleSAMLphp) and publish the necessary SAML metadata (e.g. URLs for communication, public keys, logo images). Furthermore, IdPs and SPs must trust each other (politically and technically) that the meteadata is true.
In our setup, an SP uses HTTP Redirect to send an authentication request; within the HTTP request, the SAML XML is in a Base64-encoded zlib-compressed GET parameter.
The Issuer identifies the author of the request; the value must be an URI – the convention is to use an URL where the SP’s SAML metadata is hosted.
In our setup, an IdP uses an HTTP POST to return the authentication response; within the HTTP request, the SAML XML is in a Base64-encoded zlib-compressed POST parameter.
The Issuer identifies the author of the response; the value must be an URI – the convention is to use an URL where the IdP’s SAML metadata is hosted.
The Signature contains data necessary to verify the digital signature of the SAML response; asymmetric cryptography is typically used.
The Status value shows the result of the authentication.
The Subject element contains a NameID element, which is an identifier of the user. The NameID may have multiple formats. Because it is quite complicated, most SPs prefer getting user’s identifier(s) from the attributes in the AttributeStatement (see below).
SAML assertions
SAML assertions are packets of security information containing authentication, attribute and authorization decision statements which the SP uses for access control. The assertions can be signed or encrypted independently of the rest of the SAML response.
The Signature contains data necessary to verify the digital signature of the SAML assertion; asymmetric cryptography is typically used.
The Conditions narrow down the validity of the assertion.
The AuthnStatement describes how the IdP authenticated the subject.
The AttributeStatement contains a collection of subject attributes (see below).
SAML attributes
SAML attributes are simple name-value pairs – values are typically plain text strings. Since both SP and IdP must recognize the attributes they exchange, attribute names usually follow one or more common schemas such as LDAP schema, eduPerson schema or SCHAC schema.
Best practice is for an SP to require a minimum set of attributes. This approach is both favoured by GDPR and decreases the risk of an IdP failing to send an attribute it does not recognize.
SAML federation
A SAML federation collects published metadata from all of its member IdPs and SPs, aggregates it in a single XML file and distributes the file back to the member IdPs and SPs. As a result, each IdP has a list of all SPs in the federation and vice versa. A federation can use dedicated software like pyFF to do this.
Furthermore, in a federated environment, SAML metadata can contain Entity Categories. SPs labeled with a category must conform to all of its required characteristics (e.g. having a Code of Conduct) and this information can be used by an IdP (e.g. include or exclude some attributes). IdPs labeled with a category claim interoperability with a respective SP category and this information can be used by SP (e.g. optimize user experience of authentication). Entity categories can be self-declared or assigned by the federation.