SAML (Security Assertion Markup Language)
Also called SAML 2.0.
An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app.
Last updated
What it is.
SAML has two sides. The identity provider (IdP) is where the company manages staff accounts, such as Okta, Microsoft Entra ID or Google Workspace. The service provider (SP) is your app. When a user logs in, your app redirects them to the IdP, the IdP checks them and sends back a signed assertion that says who they are.
SAML is the older of the two main ways to do enterprise SSO. OpenID Connect, built on OAuth, is newer and uses JSON. Many large companies still ask for SAML by name.
Why it matters
Supporting SAML is often a hard requirement in enterprise deals. IT teams want to switch off a leaver's access in one place and enforce their own password and MFA rules. Without it, a product can stall in a security review.
In a product build
We use a well-tested SAML library or an auth provider rather than parsing XML ourselves, validate signatures and audience on every assertion, and give each customer tenant its own IdP settings. Account provisioning, often with SCIM, is planned alongside it.
Common mistakes.
- 01
Writing your own XML signature checks. Subtle bugs here let attackers forge logins.
- 02
Allowing password login to stay on for SSO users, so leavers keep a back door.
- 03
Matching users by email only, without handling email changes or duplicate accounts.
Read the official text.
Primary sources this definition is based on.
- OASIS SAML 2.0 specifications (core, bindings, profiles)checked 2026-10-25
Work it out with a tool.
Related terms.
- SSO (single sign-on)One login, managed by an identity provider, that gives a person access to many separate apps.
- OAuth 2.0A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
- RBAC (role-based access control)An access model where permissions are attached to roles, and people get access by being given a role.
- Multi-tenancyOne running copy of a software product serving many customers, called tenants, with each tenant's data kept apart.
- Audit logA record of who did what in a system, when and from where, kept so actions can be traced later.
