SAML (Security Assertion Markup Language)
An XML-based open standard for exchanging authentication and authorization data between parties.
Detailed Explanation
SAML is the older, more complex cousin of OIDC. It is still the dominant standard for Enterprise SSO (like Okta, Azure AD). It uses XML 'assertions' to pass identity information from an Identity Provider to a Service Provider. While powerful, it is generally considered harder to implement than modern OIDC/JWT-based flows.
Quick Summary
SAML is the XML-based SSO standard that still rules enterprise IT. It is verbose and historically buggy to implement, but it remains required by most corporate IdPs (Okta, Azure AD, ADFS, OneLogin).
Key Takeaways
- Two main flows: SP-initiated (user starts at your app, redirected to IdP) and IdP-initiated (user starts at the IdP portal).
- Assertions are XML documents signed by the IdP; you must verify the signature against the IdP's certificate.
- Configuration is metadata-driven: XML files exchanged between IdP and SP with endpoints, certs, and entity IDs.
- XML signature handling has produced many critical CVEs, use a vetted library, never roll your own parser.
- Just-in-Time (JIT) provisioning creates users on first login; SCIM handles ongoing sync.
When to use it
- Enterprise B2B SaaS where the customer requires SSO via their existing IdP.
- Internal apps inside large companies already standardized on Okta or Azure AD.
- Industries (finance, healthcare, government) where SAML is mandated for compliance.
- Integrations with legacy systems that pre-date OIDC adoption.
Common Mistakes
- Implementing SAML by hand, XML signature wrapping, canonicalization, and namespace handling are notorious for vulnerabilities.
- Not validating the assertion's `Audience`, `Conditions`, and `NotBefore`/`NotOnOrAfter` constraints.
- Allowing IdP-initiated flows without CSRF protection, they're inherently CSRF-prone.
- Charging extra for SAML support; in enterprise sales it's increasingly seen as anti-customer security.
SAML (Security Assertion Markup Language), Frequently Asked
SAML or OIDC for new B2B SaaS?
Support both. Customers' IdPs determine which they'll use, and large enterprises often still require SAML. Modern OIDC support attracts startups and SMBs; SAML support is non-negotiable for enterprise deals.
What's the easiest way to add SAML?
Use a hosted identity provider (Auth0, WorkOS, Clerk, Frontegg) that handles SAML on your behalf and exposes OIDC or a simple SDK to your app. Building SAML from scratch is rarely worth it given the security history.