IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
SAML — enterprise SSO
Priya signs in to her company portal once in the morning. After that, every work app lets her in all day. The standard behind this is SAML. Your goal: know what a SAML login sends and what the app must check.
- SAML sends a signed XML statement, called an assertion.
- The IdP checks the user. The SP is the app that trusts the IdP.
- The SP checks signature, audience, time and InResponseTo.
- SP-initiated login is safer than IdP-initiated.
- Use SAML for old company apps. Use OIDC for new things.
The assertion
SAML (Security Assertion Markup Language) lets one system tell another system about a person. It says: "I checked this person, and here is what I know." The message is a SAML assertion. It is a signed statement written in XML. For example: "This is Priya, verified at 09:14, in the Finance group." The signature makes it trustworthy. Change one byte and the signature breaks.
an exam hall ticket. The board prints your name, centre and date, and its stamp proves it is real. The hall checks the stamp, the centre and the date. A ticket for another centre, or an old date, is turned away. An assertion works the same way.
Two roles: IdP and SP
The identity provider (IdP) is where Priya really logs in. It holds the passwords. The service provider (SP) is the app she wants to use. It trusts the IdP, so it has no login of its own and never sees Priya's password.
Her mail app, expense tool and HR portal are all SPs. That is single sign-on: one login, many apps. Enterprise SSO and home-realm discovery shows how a user finds the right IdP.
Trust is set up once
First, the SP and IdP agree to trust each other. They swap a small file once. This is the metadata exchange. The file lists certificates, so signatures can be checked, and web addresses.
Who starts the login
In an SP-initiated login, Priya goes to the app first. The SP sends her to the IdP with a request. In an IdP-initiated login, she starts at a company launch page and clicks an app tile. The IdP sends an assertion with no request before it.
SP-initiated is usually safer. The SP can match the reply to its request with an InResponseTo value. That shuts out assertions that were replayed or pushed in from nowhere. IdP-initiated has no such anchor. RelayState carries the page Priya wanted, so she lands there after login.
What the SP checks
✍️ Signature and Issuer
The assertion's Issuer names the IdP that made it. Check the signature with that IdP's certificate from the metadata. Skip it, and anyone can forge an assertion.
🎯 Audience
Confirm the Audience names this SP. Skip it, and an assertion made for another app could be replayed here.
⏱️ Time window
Check that "now" lies between NotBefore and NotOnOrAfter. Skip it, and an old assertion works forever.
🔗 InResponseTo
For SP-initiated login, match InResponseTo to the request the SP really sent. Skip it, and unasked assertions walk in.
The classic SAML attack is XML Signature Wrapping. The attacker wraps a forged block around a real signed one. The SP checks the real signature but reads the fake data. The defense: check the signature first, then read only the exact element that the signature covers.
SAML or OIDC
| Use… | When… |
|---|---|
| SAML | You connect to older or company apps that already speak it, or a partner's IdP offers only SAML. |
| OIDC | You build anything new: mobile apps, single-page apps, APIs. It uses JSON and JWTs and is lighter. See the auth-code lesson. |
Go deeper: more SAML checks
SAML parsers have had other XML bugs too, so use a well-tested library and keep it updated. Never trust an assertion that did not pass the whole checklist.
SAML also has its own sign-out. See Signing out across apps.
Each SAML party gives its metadata file to the other. Both sides need a signature and this one-time swap, whichever side starts the login.
Now play it. In the lab, follow Priya's payroll login step by step. Then break it four ways: an edited assertion, one for another app, an old one and an unasked one.
🧪 Interactive lab — enable JavaScript to play with this one.
Grade SAML metadata for certificate and signature-wrapping weaknesses with SAML Scan. Or paste a full response into SAML Response Check.