1 min lesson
SAML at config depth
Use "SAML at config depth" to explain each part and the role it plays.
Step 1 of 2
Every IT technical screen reaches the same moment: "a user can't log into app X via SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. - walk me through it." The candidates who pass don't recite the spec, they read a decoded assertion out loud and name the field that's wrong.
SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. is a browser-redirect protocol that lets a user authenticate once at the IdP (Okta, Entra) and ride that login into a SP (the app - Slack, Zoom, an internal tool). The IdP packages identity into a signed XML assertion and the SP trusts it because of a shared certificate. Nothing in the flow is secret; the trust comes entirely from the signature.
- IdP - Identity Provider
- Holds the identity and signs the assertion (Okta, Entra, Google)
- SP - Service Provider
- The app the user wants in; consumes the assertion at its ACS URL
- Assertion
- Signed XML stating who the user is, plus attributes, plus validity conditions
- Metadata
- XML the two sides exchange once: entity IDs, ACS URL, signing certificate