Search /
Advanced search  |  Help  |  Site map
Click for Layer 8! No, really, click NOW!
Networking for Small Business
Kill switches coming to iPhone, Android, Windows devices in 2015
Still deploying 11n Wi-Fi?  You might want to think again
9 Things You Need to Know Before You Store Data in the Cloud
Can Heartbleed be used in DDoS attacks?
Linksys WRT1900AC Wi-Fi router: Faster than anything we've tested
Heartbleed bug is irritating McAfee, Symantec, Kaspersky Lab
10 Hot Hadoop Startups to Watch
Server makers rushing out Heartbleed patches
Fortinet, McAfee, Trend Micro, Bitdefender battle in socially-engineered malware prevention test
Net neutrality ruling complicates US transition to IP networks
6 Social Media Mistakes That Will Kill Your Career
Canonical's new Ubuntu focuses on the long haul
4 Qualities to Look for in a Data Scientist
Big bucks going to universities to solve pressing cybersecurity issues
Mozilla appoints former marketing head to interim CEO
Box patches Heartbleed flaw in its cloud storage systems
Obama administration backs disclosing software vulnerabilities in most cases
6 Amazing Advances in Cloud Technology
Collaboration 2.0: Old meets new
Data breaches nail more US Internet users, regulation support rises
With a Wi-Fi cloud service, Ruckus aims to help hotspot owners make money
How to get Windows Phone 8.1 today
Secure browsers offer alternatives to Chrome, IE and Firefox
10 Big Data startups to watch

Send to a friend Feedback

Technology Update:

SAML promises Web services security

Related linksToday's breaking news
Send to a friendFeedback

Security Assertion Markup Language 1.0 is a new proposed standard for interoperability among Web services security products. As corporations increasingly deploy access management solutions and other security products in Web services environments, SAML 1.0 has the potential to be a critical interoperability standard for securing these online environments from end to end, both within organizations and from business to business.

SAML 1.0, nearing ratification by the Organization for the Advancement of Structured Information Standards, works with XML and Simple Object Access Protocol (SOAP).

SAML 1.0 defines SOAP-based interactions among security and policy domains, supporting Web single sign-on (SSO), authentication and authorization. The standard defines request and response "assertion" messages that security domains exchange to vouch for authentication decisions, authorization decisions, and attributes that pertain to named users and resources.

SAML 1.0 also defines functional entities such as authentication authorities, attribute authorities, policy decision points and policy enforcement points.

In a SAML-enabled Web SSO scenario, users log on to their home or "source" domains through authentication techniques such as ID/password. The source domain communicates this authentication decision, plus other information that provides a security context for that decision, to one or more affiliated or federated destination domains through messages that contain SAML "authentication assertions" and "attribute assertions."

The SAML scenario

In the most basic SAML 1.0 interoperability scenario supporting Web SSO, the browser/artifact profile, a user interacts with SAML-enabled Web sites as follows:

  • User's browser accesses source site (which functions as a SAML authentication authority), usually via HTTP/Secure Sockets Layer (SSL).

  • Source site challenges browser for user ID and password.

  • Browser responds to challenge by entering user ID and password.

  • Source site authenticates browser through call to external authenticating server, such as a Lightweight Directory Access Protocol directory.

  • Browser requests, via clicking on a universal resource indicator (URI) posted on source site, a particular resource residing on destination server, thereby redirecting to the source site's "intersite transfer service" URL.

  • Source site holds session and produces a short-lived SAML authentication to assert that an event has taken place (subject to conditions on the authentication assertion, along with policies defined by the requested destination server and resource).

  • Source site holds assertion message locally in cache.

  • Source site returns to browser, via SSL, a URI that includes an appended SAML "artifact" (an eight-byte Base64 string) that points to the authentication assertion and redirects the browser to the requested destination site and resource.

  • Destination site uses the SAML artifact to query/retrieve the referenced authentication assertion from the source site (usually over SSL sessions).

  • Destination site holds session, parses/ verifies authentication assertion message (and validates optional XML Signature on message, if this technique has been used), and grants browser access to requested resources.

    While it continues to gain marketplace traction, SAML 1.0 is still a new specification whose long-term viability remains unproven. The true test of SAML 1.0, as of any standard, will be in how well the market accepts the proposed standard and enables development of Web services through products that support it. Web security solution vendors are hard at work ironing out the myriad technical details necessary to support interoperability among their diverse SAML 1.0 implementations.

  • End user’s browser accesses authentication server, and authentication server asks for user ID and password.   End user requests a resource from destination/Web services server. Authentication server opens a session with destination server.
    End user enters ID and password. Authentication server checks with LDAP directory and then authenticates end user.   Authentication server sends uniform resource identifier (URI) to end user. End user browser is redirected to URI, which  connects end user to Web service.

    Related Links

    Kobielus is senior analyst at The Burton Group and a Network World columnist. He can be reached at

    SAML gains steam
    An XML protocol that appears on its way to becoming a key building block for standards-based security picked up momentum last week as vendors introduced products and vowed to provide free access to their patents to advance the cause.
    Network World, 05/06/02.

    Top Web services worry: Security
    The absence of security and reliability is proving to be a major stumbling block in convincing companies that Web sesrvices can thrive outside of corporate firewalls.
    Network World, 01/21/02.

    Above the Cloud
    An archive of James Kobielus' Network World columns.

    NWFusion offers more than 40 FREE technology-specific email newsletters in key network technology areas such as NSM, VPNs, Convergence, Security and more.
    Click here to sign up!
    New Event - WANs: Optimizing Your Network Now.
    Hear from the experts about the innovations that are already starting to shake up the WAN world. Free Network World Technology Tour and Expo in Dallas, San Francisco, Washington DC, and New York.
    Attend FREE
    Your FREE Network World subscription will also include breaking news and information on wireless, storage, infrastructure, carriers and SPs, enterprise applications, videoconferencing, plus product reviews, technology insiders, management surveys and technology updates - GET IT NOW.