SAML

Problem

An employee logs into the corporate identity system. A separate enterprise web application needs to trust that login without maintaining its own password.

Solution — SAML

SAML stands for Security Assertion Markup Language. The identity provider sends a signed assertion to the application.

Identity Provider
      ↓
"User Alice authenticated"
      ↓
Application

In a typical browser login, the application redirects you to the identity provider. After sign-in, the provider returns a page with a hidden form that automatically POSTs the SAML response through your browser to the application. The application checks the signature, intended recipient, expiry, and login-request match, then creates a session tracked by a browser cookie. This flow uses XML over HTTP, without SOAP.

Core idea: SAML enables federated identity, especially in enterprise browser-based SSO.