Cyberstudy
PDF p.108 In progress

Security Assertion Markup Language (SAML)

Open PDF at p.108 10 flashcards

Summary

PDF p.108

Security Assertion Markup Language (SAML) is a protocol used in federated networks to implement user identity assertions and transmit claims between the principal, the relying party, and the identity provider. SAML assertions are written in XML and use digital signatures to ensure trust.

In plain words

Supplementary — not from your PDF

SAML is a federation standard where the identity provider sends a signed XML assertion saying who you are. The service provider checks the signature to trust it. It's common for enterprise web single sign-on.

Detailed explanation

PDF p.108
  • Federated Network Requirements
    • Purpose: Implement user identity assertions and transmit claims.
    • Protocol: SAML is used to achieve this.
  • SAML Assertions
    • Format: Written in eXtensible Markup Language (XML).
    • Communication: Established using HTTP/HTTPS and Simple Object Access Protocol (SOAP).
    • Security: Tokens are signed using the XML signature specification, allowing the relying party to trust the identity provider.
  • Example Implementation
    • Amazon Web Services (AWS): Functions as a SAML service provider, enabling companies to manage user identities and permissions without creating direct accounts on AWS.
  • SAML Response Example 
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="200" Version="2.0"
IssueInstant="2020-01-01T20:00:10Z" Destination="https://sp.foo/saml/acs" InResponseTo="100">
  <saml:Issuer>https://idp.foo/sso</saml:Issuer>
  <ds:Signature>...</ds:Signature>
  <samlp:Status>...(success)...</samlp:Status>
  <saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="2000" Version="2.0"
  IssueInstant="2020-01-01T20:00:09Z">
    <saml:Issuer>https://idp.foo/sso</saml:Issuer>
    <ds:Signature>...</ds:Signature>
    <saml:Subject>...
    <saml:Conditions>...
    <saml:AudienceRestriction>...
    <saml:AuthnStatement>...
    <saml:AttributeStatement>
      <saml:Attribute>...
      <saml:Attribute>...
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>

Important terms

taken from the text above
Protocol
SAML is used to achieve this.
Amazon Web Services (AWS)
Functions as a SAML service provider, enabling companies to manage user identities and permissions without creating direct accounts on AWS.
SAML Security Assertion Markup Language SOAP Simple Object Access Protocol AWS Amazon Web Services

Examples & real-world scenarios

Supplementary — not from your PDF
  • Company SSO into a cloud console using SAML.
  • An XML assertion with the issuer, subject and signature.
  • SAML exchanged over HTTPS.

Scenario

A company connects its identity provider to a cloud platform using SAML. Staff sign in with company credentials, and permissions come from attributes in the assertion.

Common mistakes

Supplementary — not from your PDF
  • Mixing up SAML (XML, enterprise SSO) with OAuth (authorization tokens for APIs).
  • Forgetting that the XML signature is what creates trust.

Practical skills

Supplementary — not from your PDF
  • Name the main parts of a SAML response.

What I should remember

Key Points PDF p.108
  • Federated Network Requirements
    • User Identity Assertions: Implemented using SAML.
    • Protocol: SAML for transmitting claims.
  • SAML Assertions
    • XML Format: Written in XML.
    • Communication: HTTP/HTTPS and SOAP.
    • Security: Digital signatures for trust.
  • Example Implementation
    • AWS: SAML service provider for managing user identities and permissions.
  • SAML Response Example
    • Structure: XML format with elements like <samlp:Response>, <saml:Issuer>, <ds:Signature>, and <saml:Assertion>.