Reference

SAML glossary

Industry jargon, explained simply.

SAML

Security Assertion Markup Language: the standard for exchanging identity between an application and an identity provider, version 2.0.

SSO

Single sign-on: log in once, access several applications.

IdP

Identity provider: the service that authenticates people (Entra ID, Okta, Keycloak…).

SP

Service provider: the application that delegates login to the IdP.

Entity ID

The unique name of a party (IdP or SP), often a URL. Must be identical on both sides, character for character.

Metadata

XML document describing a party: Entity ID, addresses, certificates. Import it rather than retyping.

ACS

Assertion Consumer Service: the application address that receives the SAML response.

SSO URL

The address of the IdP that receives login requests.

AuthnRequest

The login request sent by the application to the IdP.

Response

The message returned by the IdP: a status and, if all goes well, an assertion.

Assertion

The "badge": the IdP's signed statement about the person's identity.

NameID

The person's identifier in the assertion (email, persistent or transient identifier).

Attribute

A piece of information about the person (name, email, groups) carried in the assertion. Also called a claim at Microsoft.

Audience

The application the assertion is issued for. Must be the SP's Entity ID.

NotBefore / NotOnOrAfter

Start and end of the assertion's validity. Hence the importance of synchronised clocks.

InResponseTo

The ID of the request the response answers. It links the two, and limits replay.

RelayState

A parameter that makes the round trip unchanged, often to return to the requested page.

Binding

How a message travels: Redirect (in the URL), POST (in a form), Artifact.

SP-initiated

Login started from the application.

IdP-initiated

Login started from the IdP portal, without a prior request.

Signature XML

The "seal" of the assertion or the response (XML-DSig). Proves origin and integrity.

Certificate

Contains the public key used to verify signatures. It expires: renewing it is a classic cause of outages.

Canonicalisation (c14n)

Normalised formatting of the XML before signing, so that harmless variations do not break the signature.

XSW

XML Signature Wrapping: an attack that slips a fake assertion next to the genuine signed one.

SLO

Single logout: close all sessions at once.

SessionIndex

Session identifier on the IdP side, used for logout.