Search /
Advanced search  |  Help  |  Site map
Click for Layer 8! No, really, click NOW!
Networking for Small Business
FCC defends new net neutrality proposal
New iPad rumor rollup for week ending April 23
Dell adds Big Switch to its SDN mix
Google Plus now minus chief Vic Gundotra
Heartbleed prompts joint vendor effort to boost OpenSSL, security
Microsoft Surface Mini seems likely to ship soon
China working on Linux replacement for Windows XP
FCC adds $9 billion to broadband subsidy fund
Raspberry Pi alternatives emerge to fill need for speed
It's now possible to wirelessly charge 40 smartphones from 16 feet away
Ex-FCC commissioner to head CTIA in latest Washington shuffle
Go time traveling with Google Maps
While Heartbleed distracts, hackers hit US universities
Survey respondents shun much-hyped mobile shopping technologies
7 Ways to Advance Your Project Management Career
How Apple's billion dollar sapphire bet will pay off
US to vote on sharp increase in broadband subsidies
iPhone 6 rumor rollup for the week ending April 18
NSA spying revelations have tired out China's Huawei
Arista co-founder may have switch maker by its jewels
Open source pitfalls – and how to avoid them
AT&T's expanded 1 Gbps fiber rollout could go head to head with Google
Verizon: Web apps are the security punching bag of the Internet

Send to a friend Feedback

Technology Update:

SAML promises Web services security

Related linksToday's breaking news
Send to a friendFeedback

Security Assertion Markup Language 1.0 is a new proposed standard for interoperability among Web services security products. As corporations increasingly deploy access management solutions and other security products in Web services environments, SAML 1.0 has the potential to be a critical interoperability standard for securing these online environments from end to end, both within organizations and from business to business.

SAML 1.0, nearing ratification by the Organization for the Advancement of Structured Information Standards, works with XML and Simple Object Access Protocol (SOAP).

SAML 1.0 defines SOAP-based interactions among security and policy domains, supporting Web single sign-on (SSO), authentication and authorization. The standard defines request and response "assertion" messages that security domains exchange to vouch for authentication decisions, authorization decisions, and attributes that pertain to named users and resources.

SAML 1.0 also defines functional entities such as authentication authorities, attribute authorities, policy decision points and policy enforcement points.

In a SAML-enabled Web SSO scenario, users log on to their home or "source" domains through authentication techniques such as ID/password. The source domain communicates this authentication decision, plus other information that provides a security context for that decision, to one or more affiliated or federated destination domains through messages that contain SAML "authentication assertions" and "attribute assertions."

The SAML scenario

In the most basic SAML 1.0 interoperability scenario supporting Web SSO, the browser/artifact profile, a user interacts with SAML-enabled Web sites as follows:

  • User's browser accesses source site (which functions as a SAML authentication authority), usually via HTTP/Secure Sockets Layer (SSL).

  • Source site challenges browser for user ID and password.

  • Browser responds to challenge by entering user ID and password.

  • Source site authenticates browser through call to external authenticating server, such as a Lightweight Directory Access Protocol directory.

  • Browser requests, via clicking on a universal resource indicator (URI) posted on source site, a particular resource residing on destination server, thereby redirecting to the source site's "intersite transfer service" URL.

  • Source site holds session and produces a short-lived SAML authentication to assert that an event has taken place (subject to conditions on the authentication assertion, along with policies defined by the requested destination server and resource).

  • Source site holds assertion message locally in cache.

  • Source site returns to browser, via SSL, a URI that includes an appended SAML "artifact" (an eight-byte Base64 string) that points to the authentication assertion and redirects the browser to the requested destination site and resource.

  • Destination site uses the SAML artifact to query/retrieve the referenced authentication assertion from the source site (usually over SSL sessions).

  • Destination site holds session, parses/ verifies authentication assertion message (and validates optional XML Signature on message, if this technique has been used), and grants browser access to requested resources.

    While it continues to gain marketplace traction, SAML 1.0 is still a new specification whose long-term viability remains unproven. The true test of SAML 1.0, as of any standard, will be in how well the market accepts the proposed standard and enables development of Web services through products that support it. Web security solution vendors are hard at work ironing out the myriad technical details necessary to support interoperability among their diverse SAML 1.0 implementations.

  • End user’s browser accesses authentication server, and authentication server asks for user ID and password.   End user requests a resource from destination/Web services server. Authentication server opens a session with destination server.
    End user enters ID and password. Authentication server checks with LDAP directory and then authenticates end user.   Authentication server sends uniform resource identifier (URI) to end user. End user browser is redirected to URI, which  connects end user to Web service.

    Related Links

    Kobielus is senior analyst at The Burton Group and a Network World columnist. He can be reached at

    SAML gains steam
    An XML protocol that appears on its way to becoming a key building block for standards-based security picked up momentum last week as vendors introduced products and vowed to provide free access to their patents to advance the cause.
    Network World, 05/06/02.

    Top Web services worry: Security
    The absence of security and reliability is proving to be a major stumbling block in convincing companies that Web sesrvices can thrive outside of corporate firewalls.
    Network World, 01/21/02.

    Above the Cloud
    An archive of James Kobielus' Network World columns.

    NWFusion offers more than 40 FREE technology-specific email newsletters in key network technology areas such as NSM, VPNs, Convergence, Security and more.
    Click here to sign up!
    New Event - WANs: Optimizing Your Network Now.
    Hear from the experts about the innovations that are already starting to shake up the WAN world. Free Network World Technology Tour and Expo in Dallas, San Francisco, Washington DC, and New York.
    Attend FREE
    Your FREE Network World subscription will also include breaking news and information on wireless, storage, infrastructure, carriers and SPs, enterprise applications, videoconferencing, plus product reviews, technology insiders, management surveys and technology updates - GET IT NOW.