📖 What is Security Assertion Markup Language (SAML)?
Security Assertion Markup Language (SAML) is an XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider. It is primarily used to enable Single Sign-On (SSO) across different security domains.
"Distinguish SAML (which uses XML and focuses on Identity) from OAuth (which uses JSON and focuses on Authorization) for the exam."
📚 Certification: CCSP (CCSP)
🔑 What are the Key Concepts of Security Assertion Markup Language (SAML)?
- ▸ Identity Provider (IdP) acts as the trusted authority that authenticates the user and generates the SAML assertion to be sent to the service provider.
- ▸ Service Provider (SP) is the cloud application or resource that consumes the SAML assertion to grant the user access based on the IdP's verification.
- ▸ SAML Assertions are XML-based tokens containing statements about the user's identity, attributes, and authentication status, signed digitally to ensure integrity and authenticity.
- ▸ Federated Trust is established through the exchange of metadata, including public keys and endpoints, allowing the IdP and SP to trust each other's assertions.
- ▸ Single Sign-On (SSO) enables a user to authenticate once with a central IdP and gain access to multiple independent service providers without re-entering credentials.
🎯 How does Security Assertion Markup Language (SAML) appear on the CCSP Exam?
You may be asked to identify the correct protocol for a corporate environment where users must access multiple third-party SaaS applications using a single set of internal credentials via a central identity provider.
A scenario might describe a cloud migration where a company needs to federate their on-premises Active Directory with a cloud service provider to enable seamless user access without duplicating user accounts.
Expect questions that require you to distinguish between SAML and OAuth when designing a cloud architecture, specifically focusing on whether the goal is identity federation or resource authorization.
❓ Frequently Asked Questions
What is the role of the XML signature in a SAML assertion?
The signature ensures the assertion has not been tampered with during transit. The Service Provider uses the Identity Provider's public key to verify the signature, confirming the assertion's origin and integrity.
Can SAML be used for mobile app authorization?
While possible, SAML is cumbersome for mobile apps due to its XML overhead. OAuth 2.0 and OpenID Connect are preferred for mobile and API-driven environments because they use lightweight JSON tokens.