Security Assertion Markup Language (SAML)

SAML standardizes how credentials are represented, in an XML format called assertions, which lets separate applications interoperate. One of its most common uses is browser-based single sign-on, where SAML passes an authenticated user into applications so that they can defer authentication to a central identity solution.

NIST SP 800-63C lists the SAML assertion format, alongside the OpenID Connect ID token, as an example of the assertions used in federation, and requires the relying party to validate each assertion from the identity provider. In the SAML Web SSO profile, the assertion is presented in the front channel, through the user's browser, which exposes it to parties other than the identity provider and the relying party. In the artifact binding, it is presented in the back channel. A SAML assertion can be encrypted with XML Encryption.

CISA and NSA guidance warns that SAML needs specific implementation and hardening measures to be a secure SSO option, because it is prone to exploits when not implemented correctly. OWASP describes XML signature wrapping attacks against SAML implementations and recommends schema validation of every SAML document before any security use, along with secure validation of the digital signature.

Forged SAML tokens let an adversary authenticate across services that use SAML 2.0 for SSO. MITRE ATT&CK tracks this as technique T1606.002. An adversary who holds a valid token-signing certificate can forge tokens with any permissions claims and lifetimes, and the forged tokens may bypass multi-factor authentication. The identity provider's token-signing certificate and its private keys are therefore high-value assets to protect.