Working with SAML Authentication
1. Understanding SAML 2.0 Protocol
Aspect Detail Format XML-based assertions Use Enterprise SSO, federation Specs SAML 2.0 (OASIS, 2005) Modern Alternative OIDC for new integrations
2. Understanding SAML Components
Component Role IdP (Identity Provider) Authenticates user, issues assertions SP (Service Provider) Consumes assertions, grants access Assertion Signed XML statement about user Subject NameID identifying the user Metadata XML describing endpoints + keys
3. Implementing SP-Initiated SSO Flow
1. User → SP (resource request)
2. SP → User (302 with SAML AuthnRequest)
3. User → IdP (POST/Redirect)
4. IdP authenticates user
5. IdP → User (POST SAML Response to SP ACS URL)
6. SP validates & logs user in
4. Implementing IdP-Initiated SSO Flow
Step Detail Start User clicks app in IdP portal IdP issues Unsolicited SAML Response to SP ACS SP processes No AuthnRequest to correlate Risk CSRF — verify RelayState carefully
5. Creating SAML Assertions
Example: Assertion skeleton
< saml:Assertion ID = "_abc" IssueInstant = "2026-05-18T12:00:00Z" Version = "2.0" > < saml:Issuer >https://idp.example.com</ saml:Issuer > < ds:Signature >...</ ds:Signature > < saml:Subject > < saml:NameID Format = "...emailAddress" >alice@x.com</ saml:NameID > < saml:SubjectConfirmation Method = "...bearer" > < saml:SubjectConfirmationData NotOnOrAfter = "..." Recipient = "..." InResponseTo = "..." /> </ saml:SubjectConfirmation > </ saml:Subject > < saml:Conditions NotBefore = "..." NotOnOrAfter = "..." > < saml:AudienceRestriction >< saml:Audience >https://sp.example</ saml:Audience ></ saml:AudienceRestriction > </ saml:Conditions > < saml:AuthnStatement AuthnInstant = "..." >...</ saml:AuthnStatement > < saml:AttributeStatement >...</ saml:AttributeStatement > </ saml:Assertion >
6. Signing SAML Assertions
Aspect Detail Algorithm RSA-SHA256 (xmldsig) Canonicalization Exclusive c14n Sign target Assertion (preferred) or Response or both Key IdP signing cert, distributed via metadata
7. Validating SAML Assertions
Check Detail Signature Against IdP metadata cert Issuer Expected IdP entityID Audience Equals SP entityID Conditions NotBefore / NotOnOrAfter within now Recipient Equals ACS URL InResponseTo Matches stored AuthnRequest ID Replay Cache assertion ID for Conditions window XSW Use namespace-aware, hardened parser
Warning: XML Signature Wrapping (XSW) attacks have plagued SAML libraries. Use well-maintained libraries (passport-saml, OneLogin python3-saml, Spring SAML) and update regularly.
8. Using SAML Bindings
Binding Transport Use HTTP-Redirect URL query (deflated + base64) AuthnRequest (small) HTTP-POST Form POST (base64) Response (signed XML) HTTP-Artifact Reference, resolved back-channel Reduced front-channel size SOAP SOAP envelope Back-channel logout, queries
9. Implementing SAML Logout
Flow Detail SP-initiated SP sends LogoutRequest → IdP IdP-initiated IdP sends LogoutRequest to each SP Single Logout (SLO) Cascade across all SSO sessions Reliability Best-effort — SPs may be unreachable
Element Purpose EntityDescriptor entityID + role descriptors KeyDescriptor signing / encryption certs SingleSignOnService IdP endpoints + bindings AssertionConsumerService SP ACS endpoints SingleLogoutService SLO endpoints NameIDFormat Supported NameID types
11. Using SAML Attributes
Example: AttributeStatement
< saml:AttributeStatement > < saml:Attribute Name = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" > < saml:AttributeValue >alice@example.com</ saml:AttributeValue > </ saml:Attribute > < saml:Attribute Name = "groups" > < saml:AttributeValue >admin</ saml:AttributeValue > < saml:AttributeValue >engineering</ saml:AttributeValue > </ saml:Attribute > </ saml:AttributeStatement >