This document discusses SAML (Security Assertion Markup Language), an XML-based standard for exchanging authentication and authorization data between security domains. It describes SAML's advantages like platform neutrality and loose directory coupling. The document also outlines how Liferay supports SAML through an enterprise edition plugin, allowing single sign-on between Liferay and other applications. Key features of the Liferay SAML plugin include identity provider and service provider modes as well as IdP-initiated and SP-initiated single logout.

1. SAML and Liferay
Mika Koivisto
Senior Software Engineer

2. What is SAML?
• Security Assertion Markup Language
• XML based protocol
• OASIS approved standard
• SAML 1.0 November 2002
• SAML 1.1 September 2003
• SAML 2.0 March 2005
• Flexible and extensible protocol designed to be used by
other standards

3. Why SAML?
Source: xkcd.com

4. Advantages of SAML
• Platform neutral
• Loose coupling of directories
• Improved online experience for end users
• Supported by many SaaS applications
• Increased security
• Strong commercial and open source support

5. Use Cases
• Web Single Sign-On
• Attribute based authorization
• Identity Federation
• WS-Security

6. SAML Roles
• Identity Provider (IdP) / Asserting party
• Service Provider (SP) / Relying party

7. Liferay and SAML
• Available as a EE plugin
• Supports two operation modes
• Identity Provider
• Service Provider
• Based on SAML 2.0
• Provides Web SSO between Liferay and various
applications including Salesforce and Google Apps

8. Features
• IdP initiated Web SSO
• SP initiated Web SSO
• SP initiated Single Logout
• IdP initiated Single Logout
• Consumes and Produces SAML Metadata
• Attribute statement generation (IdP)
• JIT provisioning using attribute statements (SP)

9. DEMO

10. Roadmap
• WS-Security
• Management UI
• Scalability improvements

11. Kiitos!
Mika Koivisto
Senior Software Engineer
mika.koivisto@liferay.com