SAML, developed by the Security Services Technical Committee of the Organization for the Advancement of Structured Information Standards (OASIS), is an XML-based framework for communicating user authentication, entitlement, and attribute information. As its name suggests, SAML allows business entities to make assertions regarding the identity, attributes, and entitlements of a subject (an entity that is often a human user) to other entities, such as a partner company or another enterprise application.

SAML is a flexible and extensible protocol designed to be used – and customized if necessary – by other standards. The Liberty Alliance, the Internet2 Shibboleth project, and the OASIS Web Services Security (WS-Security) committee have all adopted SAML as a technological underpinning for various purposes.

SAML History SAML V1.0 became an OASIS standard in November 2002. SAML V1.1 followed in September 2003 and has seen significant success, gaining momentum in financial services, higher education, government, and other industry segments. SAML has been broadly implemented by all major Web access management vendors. SAML support also appears in major application server products and is commonly found among Web services management and security vendors. SAML V2.0 builds on that success.

Many of these implementations have demonstrated successful interoperability at a series of events, the latest of which was held at the 2005 RSA Conference. The OASIS SAML Interoperability Lab, sponsored by the U.S. government’s General Services Administration (GSA), used three separate scenarios to demonstrate SAML-based interaction between a government or enterprise portal and sites from typical content or service providers.

SAML V2.0 unifies the building blocks of federated identity in SAML V1.1 with input from higher education’s Shibboleth initiative and the Liberty Alliance’s Identity Federation Framework. As such, SAML V2.0 is a critical step towards full convergence for federated identity standards.

Download pdf SAML V2.0 Executive Overvie