SAML promises Web services security

Security Assertion Markup Language 1.0 is a new proposed standard for interoperability among Web services security products. As corporations increasingly deploy access management solutions and other security products in Web services environments, SAML 1.0 has the potential to be a critical interoperability standard for securing these online environments from end to end, both within organizations and from business to business.

SAML 1.0, nearing ratification by the Organization for the Advancement of Structured Information Standards, works with XML and Simple Object Access Protocol (SOAP).

SAML 1.0 defines SOAP-based interactions among security and policy domains, supporting Web single sign-on (SSO), authentication and authorization. The standard defines request and response "assertion" messages that security domains exchange to vouch for authentication decisions, authorization decisions, and attributes that pertain to named users and resources.

SAML 1.0 also defines functional entities such as authentication authorities, attribute authorities, policy decision points and policy enforcement points.

In a SAML-enabled Web SSO scenario, users log on to their home or "source" domains through authentication techniques such as ID/password. The source domain communicates this authentication decision, plus other information that provides a security context for that decision, to one or more affiliated or federated destination domains through messages that contain SAML "authentication assertions" and "attribute assertions."

The SAML scenario

In the most basic SAML 1.0 interoperability scenario supporting Web SSO, the browser/artifact profile, a user interacts with SAML-enabled Web sites as follows:

User's browser accesses source site (which functions as a SAML authentication authority), usually via HTTP/Secure Sockets Layer (SSL).

Source site challenges browser for user ID and password.

Browser responds to challenge by entering user ID and password.

Source site authenticates browser through call to external authenticating server, such as a Lightweight Directory Access Protocol directory.

Browser requests, via clicking on a universal resource indicator (URI) posted on source site, a particular resource residing on destination server, thereby redirecting to the source site's "intersite transfer service" URL.

Source site holds session and produces a short-lived SAML authentication to assert that an event has taken place (subject to conditions on the authentication assertion, along with policies defined by the requested destination server and resource).

Source site holds assertion message locally in cache.

Source site returns to browser, via SSL, a URI that includes an appended SAML "artifact" (an eight-byte Base64 string) that points to the authentication assertion and redirects the browser to the requested destination site and resource.

Destination site uses the SAML artifact to query/retrieve the referenced authentication assertion from the source site (usually over SSL sessions).

Destination site holds session, parses/ verifies authentication assertion message (and validates optional XML Signature on message, if this technique has been used), and grants browser access to requested resources.

While it continues to gain marketplace traction, SAML 1.0 is still a new specification whose long-term viability remains unproven. The true test of SAML 1.0, as of any standard, will be in how well the market accepts the proposed standard and enables development of Web services through products that support it. Web security solution vendors are hard at work ironing out the myriad technical details necessary to support interoperability among their diverse SAML 1.0 implementations.

Kobielus is senior analyst at The Burton Group and a Network World columnist. He can be reached at jkobielus@tbg.com

SAML gains steam
An XML protocol that appears on its way to becoming a key building block for standards-based security picked up momentum last week as vendors introduced products and vowed to provide free access to their patents to advance the cause.
Network World, 05/06/02.

Top Web services worry: Security
The absence of security and reliability is proving to be a major stumbling block in convincing companies that Web sesrvices can thrive outside of corporate firewalls.
Network World, 01/21/02.

Above the Cloud
An archive of James Kobielus' Network World columns.