SAML Specs and Structure
SAML is standardized by OASIS, and SAML 2.0 is the mainstream version. Here is a quick breakdown of the pieces that make SAML work.
📜 SAML Specifications and Versions
SAML 2.0 is the common choice. It defines message structure, transport methods, and how metadata should be written.
Key Points
- ✅ SAML 2.0 and 1.1 messages are incompatible, but some identifiers such as emailAddress retain SAML:1.1 URIs within SAML 2.0.
- ✅ Core defines assertions and protocols; separate Bindings, Profiles and Metadata documents complement it.
- ✅ Bindings like HTTP-Redirect and HTTP-POST are the common transport methods.
- ✅ Metadata shares IdP/SP endpoints and certificates in XML.
🧩 A Closer Look at Each Part
The SAML 2.0 specs are made of multiple parts. Here is a simple breakdown of what each covers.
Version
- 📌 Align message Version, XML namespaces and profiles. Do not mechanically replace 1.1 with 2.0 inside identifier URIs.
- 📌 IdP and SP must agree on the same version.
Assertion
- 📝 The core XML that states who authenticated, when, and how.
- 📝 Includes conditions (NotBefore/NotOnOrAfter) and Audience that SP must verify.
Protocol
- 📡 Defines the format and flow of Request/Response.
- 📡 AuthnRequest and LogoutRequest/Response elements and attributes are specified here.
Binding
- 🚚 Rules for transporting messages: HTTP-Redirect, HTTP-POST, Artifact, etc.
- 🚚 Covers signatures and compression (e.g., Deflate for Redirect).
Metadata
- 📂 XML format for exchanging IdP/SP endpoints, certificates, and entity IDs.
- 📂 Used for auto-importing settings and reducing configuration mistakes.