SAML: Security Assertion Markup Language

Security Assertion Markup Language (SAML) is an XML-based standard for web browser single sign-on (SSO) that eliminates application-specific passwords. It uses single-use, expiring digital tokens to exchange authentication and authorization data between identity providers and cloud application service providers with established trust relationships. SAML's features include assertion consumer services, multiple security domain support, and its use in authentication and authorization protocols. The advantages of SAML include ease of access to multiple accounts, saved time, and increased productivity. However, it also has disadvantages such as vulnerability problems, lacking stronger authentication methods, and the critical nature of keeping the SSO system always available.

Network Defense & Counter
Measures
Case Project 11-1: Security Assertion Markup Language
(SAML)
Use the Internet to research Security Assertion Markup Language (SAML). Write a one-page
paper on your research.
SAML (Security Assertion Markup Language) is an XML-based standard for web browser single
sign-on (SSO) that eliminates application-specific passwords. SAML uses single-use, expiring,
digital "tokens" to exchange authentication and authorization data between an identity
provider and cloud application service provider that have an established trust relationship.
What are its features?
https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.m
ultiplatform.doc/ae/cwbs_samlssosummary.html
Assertion consumer service (ACS) in WebSphere SAML service provider:
ACS is a secured servlet that accepts a SAML protocol message and establishes the security
context. An ACS URL has a predefined ContextRoot as samlsps, and a URL has the following
format:
https://<host name>:<port>/samlsps/<any uri pattern>Copy
The SAMLResponse received by the ACS will be intercepted by TAI, and upon successful
validation, the request is redirected to the target application service.
Multiple security domain support:
An ACS is deployed in an application security domain, and it is expected that the ACS reside in
the same security domain as the business application. If the ACS and target business application
(RelayState) are in different security domains, the following are some recommended options:
Process the SAMLResponse in the security domain of the ACS.
Reconfigure the ACS to have the same domain as the business application.
Use the target business service as the ACS.
https://en.wikipedia.org/wiki/SAML_2.0
The resulting Authentication Request Protocol is a significant new feature of SAML 2.0.

How is it being used?
https://www.csoonline.com/article/3232355/authentication/what-is-saml-what-is-it-used-for-
and-how-does-it-work.html
http://saml.xml.org/how-saml-being-used
The Security Assertion Markup Language (SAML), is an open standard that allows security
credentials to be shared by multiple computers across a network. It describes a framework that
allows one computer to perform some security functions on behalf of one or more other
computers:
Authentication: Determining that the users are who they claim to be
Authorization: Determining if users have the right to access certain systems or content
Strictly speaking, SAML refers to the XML variant language used to encode all this information,
but the term can also cover various protocol messages and profiles that make up part of the
standard.
What are its advantages and disadvantages?
https://secureconnexion.wordpress.com/2012/08/24/the-advantages-and-disadvantages-of-
single-sign-on-sso-technology-mini-whitepaper/
Advantages
 In the healthcare industry, it could be booming with single-sign-on. If a doctor were to need
to sign-on to a database to access a patient’s files, he/she would also have to access x-rays,
and other data that would be on a different application. Having a single-sign-on for all that
would be life-saving and totally worth it. Not only had that, but hours of saved time.
 Apps such as OneLogin provide easy-access to tons of accounts across the board,
particularly social media. It says on their site that they are supporting “identity & access
management for the cloud”.
Disadvantages
 Vulnerability problems, such as with authentication, privacy keys, etc.
 The lacking of a backup stronger authentication, such as smart cards or one-time password
tokens.
 The SSO is a highly-critical tool to keep up always. If the SSO goes out, the user would lose
access to all sites.
The Pros and Cons of Single Sign-On
For Web Services

https://www.futurehosting.com/blog/the-pros-and-cons-of-single-sign-on-for-web-services/