{"head":{"title":"What Is SAML? Enterprise SSO in Plain English | OceanLab","description":"SAML is the XML standard that lets a company's identity provider log its staff into other apps. How a SAML login works, an example and the common mistakes.","canonical":"https://oceanlab.in/glossary/saml"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"SAML","path":"/glossary/saml"}],"slug":"saml","term":"SAML (Security Assertion Markup Language)","aka":["SAML 2.0"],"category":"Identity and security","short":"An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app.","body":[["SAML has two sides. The identity provider (IdP) is where the company manages staff accounts, such as Okta, Microsoft Entra ID or Google Workspace. The service provider (SP) is your app. When a user logs in, your app redirects them to the IdP, the IdP checks them and sends back a signed assertion that says who they are."],["SAML is the older of the two main ways to do enterprise ",{"href":"/glossary/sso","text":"SSO"},". OpenID Connect, built on ",{"href":"/glossary/oauth","text":"OAuth"},", is newer and uses JSON. Many large companies still ask for SAML by name."]],"why":["Supporting SAML is often a hard requirement in enterprise deals. IT teams want to switch off a leaver's access in one place and enforce their own password and MFA rules. Without it, a product can stall in a security review."],"example":["A 2,000-person company buys a project tool. Its IT team adds the tool in their IdP, uploads the app's SAML metadata and assigns the engineering group. Staff now log in with their work account, and when someone leaves, disabling them in the IdP locks them out of the tool too."],"inBuild":["We use a well-tested SAML library or an auth provider rather than parsing XML ourselves, validate signatures and audience on every assertion, and give each customer tenant its own IdP settings. Account provisioning, often with SCIM, is planned alongside it."],"mistakes":[["Writing your own XML signature checks. Subtle bugs here let attackers forge logins."],["Allowing password login to stay on for SSO users, so leavers keep a back door."],["Matching users by email only, without handling email changes or duplicate accounts."]],"related":[{"href":"/glossary/sso","label":"SSO (single sign-on)","detail":"One login, managed by an identity provider, that gives a person access to many separate apps."},{"href":"/glossary/oauth","label":"OAuth 2.0","detail":"A standard that lets an app get limited access to a user's account on another service, without ever seeing their password."},{"href":"/glossary/rbac","label":"RBAC (role-based access control)","detail":"An access model where permissions are attached to roles, and people get access by being given a role."},{"href":"/glossary/multi-tenancy","label":"Multi-tenancy","detail":"One running copy of a software product serving many customers, called tenants, with each tenant's data kept apart."},{"href":"/glossary/audit-log","label":"Audit log","detail":"A record of who did what in a system, when and from where, kept so actions can be traced later."}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/pricing/categories/auth","label":"Auth pricing","detail":"Login and identity service prices, with sources."}],"sources":[{"title":"OASIS SAML 2.0 specifications (core, bindings, profiles)","url":"https://docs.oasis-open.org/security/saml/v2.0/","checkedAt":"2026-10-25"}],"legal":false,"updatedAt":"2026-10-25"}