Reference

SAML glossary

Industry jargon, explained simply.

SAML

Security Assertion Markup Language: the standard for exchanging identity between an application and an identity provider, version 2.0.

SSO

Single sign-on: log in once, access several applications.

IdP

Identity provider: the service that authenticates people (Entra ID, Okta, Keycloak…).

SP

Service provider: the application that delegates login to the IdP.

Entity ID

The unique name of a party (IdP or SP), often a URL. Must be identical on both sides, character for character.

Metadata

XML document describing a party: Entity ID, addresses, certificates. Import it rather than retyping.

ACS

Assertion Consumer Service: the application address that receives the SAML response.

SSO URL

The address of the IdP that receives login requests.

AuthnRequest

The login request sent by the application to the IdP.

Response

The message returned by the IdP: a status and, if all goes well, an assertion.

Assertion

The "badge": the IdP's signed statement about the person's identity.

NameID

The person's identifier in the assertion (email, persistent or transient identifier).

Attribute

A piece of information about the person (name, email, groups) carried in the assertion. Also called a claim at Microsoft.

Audience

The application the assertion is issued for. Must be the SP's Entity ID.

NotBefore / NotOnOrAfter

Start and end of the assertion's validity. Hence the importance of synchronised clocks.

InResponseTo

The ID of the request the response answers. It links the two, and limits replay.

RelayState

A parameter that makes the round trip unchanged, often to return to the requested page.

Binding

How a message travels: Redirect (in the URL), POST (in a form), Artifact.

SP-initiated

Login started from the application.

IdP-initiated

Login started from the IdP portal, without a prior request.

Signature XML

The "seal" of the assertion or the response (XML-DSig). Proves origin and integrity.

Certificate

Contains the public key used to verify signatures. It expires: renewing it is a classic cause of outages.

Canonicalisation (c14n)

Normalised formatting of the XML before signing, so that harmless variations do not break the signature.

XSW

XML Signature Wrapping: an attack that slips a fake assertion next to the genuine signed one.

SLO

Single logout: close all sessions at once.

SessionIndex

Session identifier on the IdP side, used for logout.

OIDC

OpenID Connect: an identity layer on top of OAuth 2.0, which adds the ID token and the openid scope.

OAuth 2.0

Authorisation standard: gives an application an access token limited to a resource.

OP / RP

OpenID Provider (supplies the identity) and Relying Party (the application that relies on it). The OIDC equivalent of IdP and SP.

ID token

Signed JWT that proves the sign-in: issuer, audience, person, date, nonce.

Access token

Token presented to an API to prove that access is authorised. It is not meant to identify the person.

Scope

Requested scope: openid, profile, email, or specific to an API.

Claim

A piece of information about the person in a token (sub, email, name…).

PKCE

Proof tied to each request that prevents theft of the authorisation code. Required for public applications.

nonce

Random value tied to the session, returned in the ID token to prevent replay.

JWT

JSON Web Token: a compact token in three parts (header, payload, signature).