What is SAML?
Security Assertion Markup Language, an XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider.
Also known as: Security Assertion Markup Language
SAML is the protocol that powers most enterprise single sign-on. The user hits a service (the SP, Service Provider), gets redirected to their company's identity provider (the IdP), authenticates there, and is bounced back to the SP carrying a signed XML "assertion" that says who they are and what groups they belong to. The SP trusts the assertion because it was signed by the IdP's certificate.
The flow is older and more verbose than OIDC, but SAML is what corporate IT departments deployed first, which means it is what every B2B SaaS has to support to land enterprise customers. "SAML SSO" is often the gating feature for a deal with any organization larger than a few hundred employees.
Implementing SAML is finicky: XML signatures, optional encryption, multiple binding types (HTTP-POST, HTTP-Redirect, Artifact), and a long tail of IdP-specific quirks. Most teams use a library (saml2-js, python3-saml, Auth0, WorkOS, JumpCloud) rather than implementing the spec themselves.
In the wild
- A SaaS app supporting "SAML SSO" so an Okta customer's users log in with their corporate identity
- WorkOS or Auth0 abstracting the dozens of IdP integrations behind one SDK
- A JIT (just-in-time) provisioning flow creating an account on first SAML login based on group claims