A logical view of SAML 1.x

< Back to Our federated ID future

The Security Assertion Markup Language (SAML) provides a standardized way of passing sign-on and authorization information - via messages called "assertions" - between two federated domains. One domain is the source site authenticating browser-based users and the other is the destination site controlling access to the requested resource.

Functional entities typically found at the source site are:

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

< Back to Our federated ID future

The Security Assertion Markup Language (SAML) provides a standardized way of passing sign-on and authorization information - via messages called "assertions" - between two federated domains. One domain is the source site authenticating browser-based users and the other is the destination site controlling access to the requested resource.

Functional entities typically found at the source site are:

The principal - The functional entity (often a browser-based client, but it could be a Web service or application) that requests a resource.

Authentication authority - Responsible for ensuring a principal is what it says it is. The authentication authority passes credentials input by the principal to an authenticating service (such as a Lightweight Directory Access Protocol directory or RADIUS server). It then determines if the authentication was successful, and, if so, issues an authentication assertion message vouching for that.

Attribute authority - Responsible for determining what rights the principal has regarding the requested resource. It processes the authentication assertion message, retrieving the principal's attribute information from a repository (such as a LDAP directory or database) and issuing an assertion message vouching that the principal is entitled to the attributes.

Functional entities typically found at the destination site are:

Policy decision point -This functional entity processes authentication and attribute assertion messages, and evaluates those assertions against policies that are maintained in a repository. It issues authorization decision assertion messages that validate authentications and attributes.

Policy enforcement point - An entity that processes authorization decision assertions and enforces policies. At times, the policy enforcement point can be hosted on an external node.

Resource - An instance of information, services or applications requested by and delivered to principals online, subject to authentication and authorization controls. At times, the resource can be hosted on an external node.

Read more about security in Network World's Security section.