SAML 2.0

Security Assertion Markup Language 2.0 for federated identity and SSO

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

SP-Initiated SSO

Service Provider initiated Single Sign-On using the SAML 2.0 Web Browser SSO Profile (saml-profiles §4.1). The SP detects an unauthenticated user, generates an AuthnRequest, and redirects the user to the IdP for authentication. After successful authentication, the IdP returns a signed SAML Response containing an Assertion with the user's identity. This is the most common SAML SSO flow in enterprise environments.

View flow diagram

IdP-Initiated SSO

Identity Provider initiated Single Sign-On where the IdP sends an unsolicited SAML Response to the SP without a preceding AuthnRequest (saml-profiles §4.1.5). The user starts at the IdP portal and selects an application to access. This flow has inherently weaker security properties than SP-initiated SSO because the SP cannot correlate the response to an original request, making replay and CSRF attacks harder to detect.

View flow diagram

Single Logout (SLO)

SAML 2.0 Single Logout Profile terminates sessions across all federated participants - the IdP and every SP with an active session for the user (saml-profiles §4.4). When a user logs out at one participant, LogoutRequest messages are propagated to all other participants to ensure global session termination. SLO uses either front-channel (HTTP-Redirect/POST via browser) or back-channel (SOAP direct communication) bindings.

View flow diagram

Metadata Exchange

SAML 2.0 Metadata enables automated trust establishment between Identity Providers and Service Providers (SAML Metadata §2). Each party publishes an XML EntityDescriptor document describing their endpoints, supported bindings, certificates, and capabilities. This eliminates manual configuration and enables dynamic federation.

View flow diagram

Specs & references

Authoritative reading list for SAML 2.0 — core specs, security considerations, and companion standards.

SAML 2.0

Available Flows

SP-Initiated SSO

IdP-Initiated SSO

Single Logout (SLO)

Metadata Exchange

Specs & references

Core specs

Security & privacy

Companion specs

SAML 2.0 Features

SP-Initiated SSO

IdP-Initiated SSO

Single Logout (SLO)