L33
Federated identity and SAML
Cram this first — memory hook
Identity Provider identifies; Service Provider serves; Security Assertion Markup Language carries the assertion.
Exam trap
Trusting another identity provider does not mean every user from that provider automatically has every permission.
The slide facts
An Identity Provider and Service Provider establish trust. The user authenticates with the identity provider and presents an assertion/claims token to the service provider.
If you have time — extra
Federation is a trust relationship that lets one security domain rely on identity information from another. An Identity Provider () authenticates the user and issues identity assertions. A Service Provider () relies on appropriately validated assertions to establish the user's session. Security Assertion Markup Language () is a standard commonly used for this. Think of one institution accepting a verifiable visitor credential from a trusted partner. The receiver must verify the issuer/signature, intended audience, validity and other required conditions; merely possessing arbitrary XML text is not proof. Single Sign-On describes fewer repeated logins; federation describes how separate parties trust identity. They overlap but are not identical. The assertion is not a password that the should simply copy into a login box.
Walkthrough
The user requests the 's service, is redirected to the , authenticates there, receives or is carried through an assertion response, and the validates it before creating a session and applying access policy.