SAML 2.0, standardized by OASIS in 2005, enables single sign-on (SSO), identity provisioning, and attribute synchronization across various platforms, gaining support from major companies like Google, Salesforce, and Microsoft. It serves as a universal identity solvent, interoperating with multiple identity protocols such as OAuth and XACML, allowing for seamless authentication and authorization processes. Additionally, SAML's capability to facilitate just-in-time provisioning enhances user management by automatically creating and updating user accounts as needed.

1. SAML 2.0
The Universal Identity Solvent
Pat Patterson
Principal Developer Evangelist
salesforce.com

2. SAML 2.0
Standardized by OASIS, March 2005
Widely supported
– Google Apps since October 2006
– salesforce.com since Winter ’09 (October 2008)
– Microsoft Active Directory Federation Services (AD
FS) since version 2.0 (May 2010)
– Your favorite service provider!

3. SAML Providers
Service Provider
–Provides some service/resource to user
–Trusts identity provider to authenticate user
Identity Provider
–User logs in here
–Creates SAML Assertion

4. social
automate
administer
trust
Bring your own Identity single sign-on and
user management
secure single sign-on
and social apps
centralized access
management, provisioning
and reporting

5. Authenticate
SAML 2.0 Protocol
Browser
Identity Provider Service Provider
GET /something
HTTP/1.1 302 Found
Location:
http://idp.ex.com/saml?SAMLrequest=hf7893b…
&RelayState=HKFDhh383
GET
http://idp.ex.com/saml?SAMLrequest=hf78
93b…&RelayState=HKFDhh383
200 OK
SAML Assertion in HTML FORM POST /acs
SAML Assertion
HTTP/1.1 302 Found
Location: http://sp.ex.net/something
Set-Cookie: token=value; Domain=.ex.net

6. More than just Single Sign-On!
<Assertion>
<Issuer/>
<Signature/>
<Subject/>
<Conditions/>
<AttributeStatement>
<Attribute Name=”JobCode”>
<AttributeValue>
12345678
</AttributeValue>
</Attribute>
<!--
Can send any number of additional attributes
-->
</AttributeStatement>
<AuthnStatement/>
</Assertion>

7. Can even provision identities!
Just-in-time Provisioning
– Service Provider creates account if one does not
already exist, gives user immediate access
– Service Provider updates account details with
each SSO
– Sweet spot: large pool of potential users, small
number of actual users

8. SAML is Multi-Purpose!
• Single Sign-On
• Provisioning
• Synchronization
• But that’s not all!

9. Embedded SAML
• Loose coupling between identity protocols
allows us to use SAML in an OAuth flow
My Company Inc

10. SAML in OAuth

11. Other Protocols in SAML
• ‘Authenticate’ user step can be anything
• Username/password (ugh!) still most common
• Any web-based interaction
– e.g. two factor
• Wrap any protocol in HTTP
– e.g. Kerberos -> SPNEGO

12. SPNEGO – Kerberos within
SAML

13. So SAML is Composable
But wait… That’s still not all!!!

14. The SAML Assertion is a
Universal Identity Solvent!
Even competing
federation protocols
use SAML Assertion as
a token format!

15. Token Exchange
• Authorization Services can function as
RESTfulSTS’s(remember those?)
• Client app obtains SAML Assertion from
enterprise IAM infrastructure
• Authorization Service verifies Assertion, issues
token for API access
• Client app is off to the races

16. Bridging to the Brave New World
IETF Draft: SAML 2.0 Profile for OAuth 2.0 Client
Authentication and Authorization Grants

17. SAML -> OAuth -> Any API!
Enterprise apps get to play
– OpenID Connect
– SCIM
– Cloud Services
– Whatever you want

18. SAML and XACML
• SAML 2.0 Profile for XACML
• SAML as transport for XACML
attributes

19. So wait…
Not only can SAML do SSO and
provisioning…
It can also interoperate with
ALL of the other identity
protocols on stage?