SAML

In many companies, employees work daily with a dozen different programs in the browser. Managing a separate password for each one would be insecure and tedious. SAML solves this problem: it is a fixed agreement on how two computer services exchange a statement about a person. That statement essentially says: this person has logged in with us correctly, and their name is such-and-such, and they belong to this department. The service the person wants to use trusts this statement and lets them in. The abbreviation stands for Security Assertion Markup Language, roughly a markup language for security statements.

One password instead of fifty

The practical benefit is called single sign-on: you log in once in the morning and afterward enter all authorized programs without typing another password. This not only saves time. It also eliminates the habit many people have of using the same weak password everywhere.

Even more important is the control it gives the company. When someone leaves the company, the IT department only has to lock a single account. Without such a standard, it would have to check every individual application to see whether an active access still exists there. Forgotten accounts of former employees are a classic entry point for attacks.

For vendors of enterprise software, SAML support is therefore almost a sales prerequisite. Large customers demand it during the tender process. Anyone who does not offer it is disqualified from the outset with corporations and government agencies.

The ID card the browser delivers

Three parties are involved. The user sits at the browser. The service provider is the application she wants to use, for example a project tool. The identity provider is the company’s central login service, which knows the passwords and confirms the identity.

The process is always the same. The application notices that the visitor is unknown and redirects the browser to the login service. There she enters her password and usually a second factor, such as a code from an app. The login service then issues an assertion, a small structured document containing name, validity period, and permissions. The browser passes this document on to the application.

So that nobody can forge such a document themselves, it is digitally signed. A digital signature is a checksum that can only be generated with a secret key but can be verified by anyone. The application recalculates the signature and thus knows that the statement really comes from the trusted login service. Importantly, the application never sees the password itself.

The login button with the company logo

SAML becomes visible wherever a login page shows a button like “Sign in with company account” next to the password field. Anyone who clicks it briefly lands on a foreign page and is then logged in. This very intermediate step is standard practice at work. Many schools and universities also use it for learning platforms and library access.

In business news, the term appears in the context of identity providers such as Okta or Microsoft Entra. Their business model consists of operating this central point of trust for thousands of companies. If such a provider fails or is attacked, very many people are locked out everywhere at once. Centralized login increases security but also concentrates risk.

A common misconception is confusing SAML with OAuth. OAuth governs which rights an app receives over someone else’s data, such as access to a calendar. SAML, on the other hand, only answers the question of who someone is. In the consumer space, the newer OpenID Connect standard has largely replaced the older SAML. In enterprises, SAML remains very widespread because of the many existing systems.