Basics of SAML Signatures and Attributes
This document covers not only the basic mechanism of SAML, but also practical knowledge useful for real-world implementation and operation.
๐ SAML Signatures and Attributes
SAML Responses are digitally signed using XML Signatures to ensure integrity and verify the identity of the issuing IdP.
Structure of the Signature
-
๐
Signatures are located inside the
- ๐ The signature may cover the Assertion or the entire Response
- ๐ Signatures use X.509 certificates
Things to Watch When Verifying
- โ ๏ธ Time skew may cause NotBefore/NotOnOrAfter validation failures
- โ ๏ธ Check certificate validity and expiration
- โ ๏ธ Ensure the EntityID matches the expected value on the SP side
๐ Handling of Attributes
SAML Responses can include user attributes such as email or role information.
Common Attributes
- โ email: used for login ID or notifications
- โ givenName / surname: used for display name
- โ groups / roles: used for access control
Attribute Mapping
- ๐งฉ Attributes must be mapped to internal user fields on the SP side
- ๐งฉ Attribute names and namespaces vary by IdP (e.g., AzureAD, Okta)
- ๐งฉ If required attributes are missing, login may fail
โฑ๏ธ Conditions, Validity, and Errors
SAML Assertions contain conditions and expiration timestamps which must be validated by the SP.
Assertion Conditions
- ๐ NotBefore: invalid before this timestamp
- ๐ NotOnOrAfter: invalid after this timestamp (token expiration)
- ๐ Audience: must match the allowed SP EntityID
Common Errors
- ๐งฏ Signature verification error (certificate mismatch or incorrect scope)
- ๐งฏ XML parsing error (Deflate or Base64 decoding failure)
- ๐งฏ Condition mismatch error (time drift, audience mismatch)
โ๏ธ Differences and Compatibility Between SP and IdP
Differences by IdP
- ๐ง AzureAD uses URL-style EntityIDs and has automatic certificate rotation
- ๐ง Google Workspace uses a unique namespace and requires attribute adjustments
- ๐ง Okta and Keycloak support advanced SAML features but have many configuration items
SP Configuration Tips
- ๐ ๏ธ Accurately specify accepted EntityID and ACS (Assertion Consumer Service) URL
- ๐ ๏ธ Check whether metadata import is supported
- ๐ ๏ธ Enable and enforce SAML Response signature verification