What is SAML ?

SAML is the short form for Security Assertion Markup Language.
It is a xml based open standard that allows web domains to exchange user’s authentication and authorization data.

SAML involves 3 parties;

1. Identity Provider (IdP)
2. Service Provider (SP)
3. Principal (usually an end-user)

A scenario based example,

Imagine a scenario where you(In SAML jargon, a principal) need to access your company’s email hosted in microsoft office 365 (In SAML jargon, a service provider).  Your company maintains a directory of users and an authentication mechanism to authenticate using active directory (In SAML jargon, Identity Provider).

Let’s assume that company’s email is accessible at (mail.company.com)

When you want to read your emails from mail.company.com, depending on, where you are coming from it could automatically let you in, into hosted mail service with out asking for credentials. Being able to authenticate only once to your company network (or Identity Provider in SAML jargon) and subsequently login to many applications (or Service Providers) without having to type in a password again (Sounds like single sign-on right yeah, it is also known as Multi-Domain Single Sign-On  – MDSSO).

In simple words,

YOU want to consume a service provided by a provider. Since the service does not know who you are it would redirect you to the configured identity provider to make sure you are an authenticated user. All of the above is facilitated via SAML protocol/assertions.

In this case,

1. Identity Provider = Directory of users on AD.
2. Service Provider = Office 365 service from microsoft.
3. Principal = You or end user.

1. The user(Principal) attempts to reach a hosted application(Service) at https://www.mycompanymail.com from a browser.
2. Service Provider generates a SAML authentication request. The SAML request is encoded and embedded into the URL.
3. Service Provider sends a redirect to the user’s browser. The redirect URL includes the encoded SAML authentication request that should be submitted to Identity Provider (IDP).
4. The Identity Provider decodes the SAML request and extracts the necessary components of the request.
5. The Identity Provider then authenticates the user. Identity Provider could authenticate users by either asking for valid login credentials or by checking for valid session cookies.
6. The Identity Provider generates a SAML response that is digitally signed with the partner’s public and private keys.
7. The Identity Provider encodes the SAML response and returns that information to the user’s browser.
8. The Identity Provider provides a mechanism so that the browser can forward that information to service provider.
   For example,
   The Identity Provider could embed the SAML response and destination URL in a form and provide a button that the user can click to submit the form to Service Provider.
   OR
   The Identity Provider could also include JavaScript on the page that automatically submits the form to Service Provider.
9. Service Provider’s service verifies the SAML response using the Identity Provider’s public key.
10. If the response is successfully verified, The user would be redirected to the destination URL and is logged in to office 365.

The above is an example of user’s authentication using SAML assertion.
A similar kind of example could be described for user’s authorization using SAML.

How does the SAML Request & Response looks like ?

SAML Request

SAML Response

What are the scenarios in which SAML is useful ?

SAML addresses the import requirements that is single sign-on for web browser based sign-in.

For a details information, please refer to the SAML technical overview
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html