Security Assertion Markup Language (SAML)

SAML communicates using XML-based security tokens called assertions. These are not just 'logged in' flags; they are structured packets containing verified statements about a subject.

• Authentication Assertion: Proves the user authenticated successfully and specifies the method (e.g., password, MFA) and timestamp.
• Attribute Assertion: Passes specific user attributes (e.g., department, role, email) to the service provider for fine-grained access control.
• Authorization Decision Assertion: States whether a user is permitted to perform a specific action on a resource.

The most common SAML flow, where the user starts at their corporate portal. The Identity Provider (IdP)—the central authentication server—generates a SAML assertion and posts it to the Service Provider (SP).

• The user clicks a tile on their dashboard.
• The IdP creates a digitally signed assertion.
• The user's browser automatically submits this assertion to the SP via an HTTP POST binding.
• The SP validates the signature and grants access without a separate login prompt.

In this flow, the user attempts to access a protected resource directly. The Service Provider (SP) detects no active session and redirects the user to the IdP for authentication.

• The SP generates an AuthnRequest and redirects the browser to the IdP.
• The IdP authenticates the user and sends back a SAML response.
• This flow is critical for deep-linking, where a user bookmarks a specific page inside an AI governance tool.

The integrity and authenticity of a SAML assertion are guaranteed by XML Digital Signatures. The IdP signs the assertion with its private key, and the SP verifies it using the IdP's public certificate.

• Prevents assertion tampering or replay attacks in transit.
• Establishes a Circle of Trust between the IdP and SP through metadata exchange.
• Metadata XML files contain entity IDs, public keys, and endpoint URLs, enabling automated configuration of trust relationships.

SAML 2.0 defines a Single Logout profile to terminate all sessions established by a single authentication event. When a user logs out of the IdP, a <LogoutRequest> is sent to every participating SP.

• Synchronous SLO: The IdP redirects the browser to each SP sequentially to clear local cookies.
• Asynchronous SLO: The IdP sends SOAP-based logout messages directly to SP backend endpoints.
• This is essential for zero-trust architectures to ensure no orphaned sessions remain active in AI data tools.

SAML separates the structure of assertions from their transport mechanism. Bindings define how messages are carried over standard protocols.

• HTTP Redirect Binding: Used for AuthnRequests; parameters are URL-encoded.
• HTTP POST Binding: Used to deliver the assertion to the SP via an auto-submitting form.
• Artifact Binding: A small, opaque reference is sent instead of the full assertion; the SP must resolve it via a back-channel SOAP call to the IdP, enhancing security by keeping tokens off the browser.