Working with SAML Authentication
1. Understanding SAML 2.0 Protocol
| Aspect | Detail |
|---|---|
| Format | XML-based assertions |
| Use | Enterprise SSO, federation |
| Specs | SAML 2.0 (OASIS, 2005) |
| Modern Alternative | OIDC for new integrations |
2. Understanding SAML Components
| Component | Role |
|---|---|
| IdP (Identity Provider) | Authenticates user, issues assertions |
| SP (Service Provider) | Consumes assertions, grants access |
| Assertion | Signed XML statement about user |
| Subject | NameID identifying the user |
| Metadata | XML describing endpoints + keys |
3. Implementing SP-Initiated SSO Flow
1. User → SP (resource request)
2. SP → User (302 with SAML AuthnRequest)
3. User → IdP (POST/Redirect)
4. IdP authenticates user
5. IdP → User (POST SAML Response to SP ACS URL)
6. SP validates & logs user in
4. Implementing IdP-Initiated SSO Flow
| Step | Detail |
|---|---|
| Start | User clicks app in IdP portal |
| IdP issues | Unsolicited SAML Response to SP ACS |
| SP processes | No AuthnRequest to correlate |
| Risk | CSRF — verify RelayState carefully |
5. Creating SAML Assertions
Example: Assertion skeleton
<saml:Assertion ID="_abc" IssueInstant="2026-05-18T12:00:00Z" Version="2.0">
<saml:Issuer>https://idp.example.com</saml:Issuer>
<ds:Signature>...</ds:Signature>
<saml:Subject>
<saml:NameID Format="...emailAddress">alice@x.com</saml:NameID>
<saml:SubjectConfirmation Method="...bearer">
<saml:SubjectConfirmationData NotOnOrAfter="..." Recipient="..." InResponseTo="..."/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="..." NotOnOrAfter="...">
<saml:AudienceRestriction><saml:Audience>https://sp.example</saml:Audience></saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="...">...</saml:AuthnStatement>
<saml:AttributeStatement>...</saml:AttributeStatement>
</saml:Assertion>6. Signing SAML Assertions
| Aspect | Detail |
|---|---|
| Algorithm | RSA-SHA256 (xmldsig) |
| Canonicalization | Exclusive c14n |
| Sign target | Assertion (preferred) or Response or both |
| Key | IdP signing cert, distributed via metadata |
7. Validating SAML Assertions
| Check | Detail |
|---|---|
| Signature | Against IdP metadata cert |
| Issuer | Expected IdP entityID |
| Audience | Equals SP entityID |
| Conditions | NotBefore / NotOnOrAfter within now |
| Recipient | Equals ACS URL |
| InResponseTo | Matches stored AuthnRequest ID |
| Replay | Cache assertion ID for Conditions window |
| XSW | Use namespace-aware, hardened parser |
Warning: XML Signature Wrapping (XSW) attacks have plagued SAML libraries. Use well-maintained libraries (passport-saml, OneLogin python3-saml, Spring SAML) and update regularly.
8. Using SAML Bindings
| Binding | Transport | Use |
|---|---|---|
| HTTP-Redirect | URL query (deflated + base64) | AuthnRequest (small) |
| HTTP-POST | Form POST (base64) | Response (signed XML) |
| HTTP-Artifact | Reference, resolved back-channel | Reduced front-channel size |
| SOAP | SOAP envelope | Back-channel logout, queries |
9. Implementing SAML Logout
| Flow | Detail |
|---|---|
| SP-initiated | SP sends LogoutRequest → IdP |
| IdP-initiated | IdP sends LogoutRequest to each SP |
| Single Logout (SLO) | Cascade across all SSO sessions |
| Reliability | Best-effort — SPs may be unreachable |
10. Configuring SAML Metadata
| Element | Purpose |
|---|---|
| EntityDescriptor | entityID + role descriptors |
| KeyDescriptor | signing / encryption certs |
| SingleSignOnService | IdP endpoints + bindings |
| AssertionConsumerService | SP ACS endpoints |
| SingleLogoutService | SLO endpoints |
| NameIDFormat | Supported NameID types |
11. Using SAML Attributes
Example: AttributeStatement
<saml:AttributeStatement>
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
<saml:AttributeValue>alice@example.com</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="groups">
<saml:AttributeValue>admin</saml:AttributeValue>
<saml:AttributeValue>engineering</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>