<commit_before>---
layout: post
title: "How SAML Authentication Works"
description: Learn the nitty-gritty of Saml Authentication
date: 2016-11-29 08:30
category: Identity, Security, Saml
design:
  bg_color: "#001D3F"
  image: https://cdn.auth0.com/blog/PasswordlessLogo.png
author:
  name: <NAME>
  url: http://twitter.com/unicodeveloper?lang=en
  mail: <EMAIL>
  avatar: https://en.gravatar.com/avatar/1097492785caf9ffeebffeb624202d8f?s=200
tags:
- saml
- authentication
- sso
related:
- 2016-11-23-how-passwordless-authentication-works
- 2016-01-27-setting-up-passwordless-authentication-with-the-auth0-dashboard
- 2016-09-06-use-nginx-plus-and-auth0-to-authenticate-api-clients

---

---

**TL;DR:** Most applications have user authentication as an integral part of their system. The need for various forms and protocols of authentication have increased over time. One of such protocols for authentication is SAML. In this article, you'll get to understand how SAML authentication works!

---

## What is SAML?

Security Assertion Markup Language (SAML) is an XML-based framework for authentication and authorization between two entities: a Service Provider and an Identity Provider. The Service Provider agrees to trust the Identity Provider to authenticate users. The Identity Provider authenticates users and provides to Service Providers an *authentication assertion* that indicates a user has been authenticated.

SAML is a standard for single sign-on (SSO). Exchange of authentication information is done through digitally signed XML documents. It's a complex single sign-on implementation that enables seamless authentication mostly between businesses and enterprises.

With SAML, you don't have to worry about typing in some authentication credentials, remembering and resetting passwords.

## Benefits of SAML Authentication

Without much ado, the benefits of SAML authentication includes:

* **Standardization:** SAML is a standard format that allows seamless interoperability between systems independent of implementation. It takes away the common issues associated with vendor and platform-specific architecture and implementation.

* **Improved User Experience:** Providing users access to various service providers without additional authentication by allowing them sign in once allows for a faster and better user experience at each service. It eliminates the need for password issues such as reset and recovery.

* **Increased Security:** Security is a key aspect of software development. When it comes to enterprise applications, it is of extreme importance. SAML provides just one point of authentication, which happens at a secure identity provider and then SAML is used to transfer the identity to service providers. This form of authentication ensures that authentication credentials don't leave the firewall boundary.

* **Loose coupling of directories:** SAML doesn't require user information to be maintained and synchronized between directories.

* **Reduced costs for Service Providers:** With SAML, you don't have to maintain account information accross multiple services. The identity provider bears this burden.

## How Does SAML Authentication Really Work?

Let's take an in-depth look at the process flow of SAML authentication in an application. SAML single sign-on authentication typically involves a service provider and an identity provider. The process flow usually involves the *trust establishment* and *authentication flow* stages.

Consider this use case: 

- Our identity provider is **Auth0**
- Our service provider is an enterprise HR portal called **Zagadat**

**Note:** The identity provider could be any identity management platform.

Now, a user is trying to gain access to **Zagadat** using SAML authentication.

This is the process flow:

* The user tries to log into **Zagadat** from a browser
* **Zagadat** responds by generating a SAML request

![Typical SAML request](https://cdn.auth0.com/blog/samlrequestzg.png)
_Example of a SAML request_

* The browser redirects the user to a SSO URL, **Auth0**
* **Auth0** parses the SAML request, authenticates the user(this could be either via username and password or even a two-factor authentication, if the user is already authenticated on auth0, this step will be skipped) and generates a SAML response

![Typical SAML response](https://cdn.auth0.com/blog/SAMLResponse.png)
_Example of a SAML response_

* **Auth0** returns the encoded SAML response to the browser
* The browser sends the SAML response to **Zagadat** for verification
* If the verification is successful, user will be logged in to **Zagadat** and granted access to all the various resources.

Note the attributes that are highlighted in the SAML request and response. Find below a little glossary of these parameters:

* **ID:** Newly generated number for identification
* **IssueInstant:** Timestamp to indicate the time it was generated
* **AssertionConsumerServiceURL:** The SAML URL interface of the service provider, where the Identity Provider sends the authentication token.
* **Issuer:** The name(identity) of the Service Provider
* **InResponseTo:** The ID of the SAML request that this response belongs to
* **Recipient:** The name(identity) of the Service Provider

## Aside: SAML Authentication with Auth0

With Auth0, SAML authentication is dead simple to implement. We can easily configure our applications to use **Auth0 Lock** for SAML authentication. 

In the example below, we will use an Auth0 account(account 1) as a *Service Provider* and authenticate users against a second Auth0 account(account 2) which will serve as our *Identity Provider*. Follow the steps below:

## 1. Establish two Auth0 Accounts

If you do not already have two Auth0 accounts, you will need to create them. If you do already have two accounts, you can skip to step #2.

*In the Auth0 Dashboard*
<commit_msg>Add saml-authentication-flow diagram<commit_after>---
layout: post
title: "How SAML Authentication Works"
description: Learn the nitty-gritty of Saml Authentication
date: 2016-11-29 08:30
category: Identity, Security, Saml
design:
  bg_color: "#001D3F"
  image: https://cdn.auth0.com/blog/PasswordlessLogo.png
author:
  name: <NAME>
  url: http://twitter.com/unicodeveloper?lang=en
  mail: <EMAIL>
  avatar: https://en.gravatar.com/avatar/1097492785caf9ffeebffeb624202d8f?s=200
tags:
- saml
- authentication
- sso
related:
- 2016-11-23-how-passwordless-authentication-works
- 2016-01-27-setting-up-passwordless-authentication-with-the-auth0-dashboard
- 2016-09-06-use-nginx-plus-and-auth0-to-authenticate-api-clients

---

---

**TL;DR:** Most applications have user authentication as an integral part of their system. The need for various forms and protocols of authentication have increased over time. One of such protocols for authentication is SAML. In this article, you'll get to understand how SAML authentication works!

---

## What is SAML?

Security Assertion Markup Language (SAML) is an XML-based framework for authentication and authorization between two entities: a Service Provider and an Identity Provider. The Service Provider agrees to trust the Identity Provider to authenticate users. The Identity Provider authenticates users and provides to Service Providers an *authentication assertion* that indicates a user has been authenticated.

SAML is a standard for single sign-on (SSO). Exchange of authentication information is done through digitally signed XML documents. It's a complex single sign-on implementation that enables seamless authentication mostly between businesses and enterprises.

With SAML, you don't have to worry about typing in some authentication credentials, remembering and resetting passwords.

## Benefits of SAML Authentication

Without much ado, the benefits of SAML authentication includes:

* **Standardization:** SAML is a standard format that allows seamless interoperability between systems independent of implementation. It takes away the common issues associated with vendor and platform-specific architecture and implementation.

* **Improved User Experience:** Providing users access to various service providers without additional authentication by allowing them sign in once allows for a faster and better user experience at each service. It eliminates the need for password issues such as reset and recovery.

* **Increased Security:** Security is a key aspect of software development. When it comes to enterprise applications, it is of extreme importance. SAML provides just one point of authentication, which happens at a secure identity provider and then SAML is used to transfer the identity to service providers. This form of authentication ensures that authentication credentials don't leave the firewall boundary.

* **Loose coupling of directories:** SAML doesn't require user information to be maintained and synchronized between directories.

* **Reduced costs for Service Providers:** With SAML, you don't have to maintain account information accross multiple services. The identity provider bears this burden.

## How Does SAML Authentication Really Work?

Let's take an in-depth look at the process flow of SAML authentication in an application. SAML single sign-on authentication typically involves a service provider and an identity provider. The process flow usually involves the *trust establishment* and *authentication flow* stages.

Consider this use case: 

- Our identity provider is **Auth0**
- Our service provider is an enterprise HR portal called **Zagadat**

**Note:** The identity provider could be any identity management platform.

Now, a user is trying to gain access to **Zagadat** using SAML authentication.

This is the process flow:

 1. The user tries to log into **Zagadat** from a browser
 2.  **Zagadat** responds by generating a SAML request

    ![Typical SAML request](https://cdn.auth0.com/blog/samlrequestzg.png)
    _Example of a SAML request_

 3. The browser redirects the user to a SSO URL, **Auth0**
 4. **Auth0** parses the SAML request, authenticates the user(this could be either via username and password or even a two-factor authentication, if the user is already authenticated on auth0, this step will be skipped) and generates a SAML response

    ![Typical SAML response](https://cdn.auth0.com/blog/SAMLResponse.png)
    _Example of a SAML response_

 5. **Auth0** returns the encoded SAML response to the browser
 6. The browser sends the SAML response to **Zagadat** for verification
 7. If the verification is successful, user will be logged in to **Zagadat** and granted access to all the various resources.

![Process flow diagram](https://cdn.auth0.com/blog/saml-process-flow-diagram.png)
_Process Flow diagram_

Note the attributes that are highlighted in the SAML request and response. Find below a little glossary of these parameters:

* **ID:** Newly generated number for identification
* **IssueInstant:** Timestamp to indicate the time it was generated
* **AssertionConsumerServiceURL:** The SAML URL interface of the service provider, where the Identity Provider sends the authentication token.
* **Issuer:** The name(identity) of the Service Provider
* **InResponseTo:** The ID of the SAML request that this response belongs to
* **Recipient:** The name(identity) of the Service Provider

## Aside: SAML Authentication with Auth0

With Auth0, SAML authentication is dead simple to implement. We can easily configure our applications to use **Auth0 Lock** for SAML authentication. 

In the example below, we will use an Auth0 account(account 1) as a *Service Provider* and authenticate users against a second Auth0 account(account 2) which will serve as our *Identity Provider*. Follow the steps below:

## 1. Establish two Auth0 Accounts

If you do not already have two Auth0 accounts, you will need to create them. If you do already have two accounts, you can skip to step #2.

*In the Auth0 Dashboard*

{'fraction_non_alphanumeric': 0.06400134386023854, 'fraction_numerical': 0.014614480094070216, 'mean_word_length': 4.932735426008969, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 9, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1458774', 'n_tokens_mistral': 3155, 'n_tokens_neox': 2879, 'n_words': 1557}