# What is Security Assertion Markup Language (SAML)?

> Security Assertion Markup Language (SAML) is an OASIS standard for XML-encoded assertions about authentication, subject attributes, and authorization decisions, together with protocols and profiles for exchanging them.

- Canonical URL: https://yellowcube.eu/glossary/security-assertion-markup-language/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Its Web Browser Single Sign-On profile commonly lets an identity provider authenticate a user and send an assertion to a service provider that relies on that result.

In a service-provider-initiated flow, the service provider sends an authentication request and receives a SAML response through the user’s browser. The service provider validates the response and assertion, including the issuer, signature, recipient, audience, time conditions, request correlation, and subject-confirmation rules. Metadata commonly distributes entity identifiers, endpoints, supported bindings, and verification certificates between trusted parties.

### Key points

- **Assertions and profiles:** Authentication statements describe an authentication event; attribute statements carry selected subject data; profiles constrain how SAML messages are used for a particular purpose.
- **Validation:** Apply the selected profile’s complete processing rules rather than merely checking that some XML element is signed, and reject unexpected issuers, destinations, algorithms, and duplicate identifiers.
- **Operations:** Protect signing keys, plan certificate rollover and clock tolerance, minimize attributes, test identity-provider outages, and distinguish identity-provider and service-provider sessions during logout.
- **Important limitation:** SAML is a flexible federation framework, not a guarantee of secure single sign-on. Unsafe XML processing, signature-validation mistakes, stale metadata, overbroad attributes, or weak local sessions can defeat a conforming-looking integration.

### Related terms

[Federated identity](<https://yellowcube.eu/glossary/federated-identity/>) · [Single sign-on (SSO)](<https://yellowcube.eu/glossary/single-sign-on/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Authorization](<https://yellowcube.eu/glossary/authorization/>) · [OpenID Connect (OIDC)](<https://yellowcube.eu/glossary/openid-connect/>)

### Sources

[OASIS SAML V2.0 Core](https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf) · [OASIS SAML V2.0 Profiles](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf) · [OASIS SAML V2.0 Approved Errata 05](https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html) · [NIST SP 800-63C-4: Federation and Assertions](https://csrc.nist.gov/pubs/sp/800/63/c/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.