1 min lesson
SAML at config depth
Use "SAML at config depth" to explain each part and the role it plays.
Step 1 of 2
Every IT technical screen reaches the same moment: "a user can't log into app X via SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition.. Walk me through it." The candidates who pass don't recite the spec, they read a decoded assertion out loud and name the field that's wrong.
SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. is a browser-redirect protocol. The user authenticates once at the IdP, and the browser carries a signed XML assertion to the SP. The assertion is signed and, by default, readable; the trust comes entirely from the signature.
- IdP: Identity Provider
- Holds the identity and signs the assertion. Okta, Entra and Google all play this role
- SP: Service Provider
- The app the user wants in, such as Slack, Zoom or an internal tool; consumes the assertion at its ACS URL
- Assertion
- Signed XML stating who the user is, plus attributes, plus validity conditions
- Metadata
- XML the two sides exchange once: entity IDs, ACS URL, signing certificate