Federate enterprise sign-in with Security Assertion Markup Language (SAML) 2.0.
Security Assertion Markup Language (SAML) lets an enterprise identity provider send a signed authentication assertion to a service provider. This can support enterprise single sign-on (SSO).
Why this lesson?
An employee opens a software-as-a-service (SaaS) reporting application and signs in through the company identity provider instead of creating a separate password for the application.
Learning goal and prerequisites
Request the enterprise application
The user opens a protected application. Because there is no local application session, the service provider starts the Security Assertion Markup Language (SAML) Web Browser single sign-on flow and creates the information it will later use to correlate the response.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Large organizations do not want employees to create and manage a separate password for every business application. They also need one place to disable access when a person leaves or changes roles. Enterprise single sign-on (SSO) addresses that problem by letting applications trust a central identity provider for sign-in.
Security Assertion Markup Language (SAML) 2.0 is a common enterprise federation protocol. The application, called the service provider, sends the user to the organization’s identity provider. After the identity provider authenticates the user, it returns a signed SAML assertion describing the authentication result and selected attributes.
The service provider verifies the assertion before creating a local session. Important checks include the signature, issuer, intended audience, destination, time limits, and protection against replay. A signed assertion is useful only when it was created by the expected identity provider and intended for this service provider.
SAML SSO centralizes authentication, but it does not automatically manage the user’s account lifecycle or application permissions. Provisioning systems such as System for Cross-domain Identity Management handle account creation and removal, while the application still decides what the signed-in user is allowed to do.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.