Security Assertion Markup Language (SAML) is an open, XML-based standard that lets an identity provider pass authentication and authorization details to a service provider, making single sign-on possible across otherwise separate systems.
The flow is straightforward once you see it. A user signs in once to the identity provider, which issues a digitally signed assertion vouching for who they are. The service provider trusts that assertion and grants access without asking for the password again. This is the workhorse behind much of enterprise web SSO, where one login opens dozens of internal applications. Its security hinges on details that are easy to get wrong: the service provider must validate the signature and check the assertion’s conditions, such as audience and expiry, because sloppy validation has led to real authentication bypass flaws. SAML is also heavier than newer token formats, which is why many modern apps pair or replace it with OpenID Connect.
Why does SAML matter for the CISSP exam?
SAML is a core topic in Domain 5, Identity and Access Management, which carries 13 percent of the exam. Know that it enables federated identity and single sign-on, understand the identity provider and service provider roles, and be able to tell it apart from OAuth and OpenID Connect.