{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"cs/saml","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/cs/saml/","da":"https://cmaintz.github.io/tech-atlas/da/terms/cs/saml/"},"term":{"en":"SAML","da":"SAML"},"aka":{"en":["Security Assertion Markup Language","SAML 2.0"],"da":["SAML 2.0"]},"domain":["cs"],"cluster":"identity","layer":"identity","status":"current","era":2002,"summary":{"en":"An older, widely used standard for passing a signed “this user has logged in” message from an identity provider to an app.","da":"En ældre, udbredt standard, der sender en signeret “denne bruger er logget ind”-besked fra en identitetsudbyder til en app."},"body":{"formal":{"en":"An open standard in which an identity provider, after authentication, sends the user's browser to the app carrying a signed document, called an assertion, that states who the user is and facts about them; the app checks the signature and trusts it.","da":"En åben standard, hvor en identitetsudbyder efter autentificering sender brugerens browser videre til appen med et signeret dokument, en såkaldt assertion, der angiver, hvem brugeren er, og oplysninger om vedkommende; appen kontrollerer signaturen og stoler på indholdet."},"plain":{"en":"Like a sealed letter of introduction from your employer - the hotel does not know you, but it knows the seal and lets you in.","da":"Som et forseglet anbefalingsbrev fra din arbejdsgiver - hotellet kender ikke dig, men det kender seglet og lukker dig ind."},"inPractice":{"en":"A nurse at a regional hospital clicks the icon for the shift-planning system, is sent briefly to the region's login page, and lands back in the planning system already logged in - the SAML message did the work in between.","da":"En sygeplejerske på et regionshospital klikker på ikonet for vagtplanlægningssystemet, sendes et øjeblik til regionens loginside og lander igen i vagtplanen som logget ind - SAML-beskeden klarede arbejdet imellem."},"whyItMatters":{"en":"It lets organisations connect hundreds of business apps to one login and one place to close accounts, and much of the enterprise world still runs on it.","da":"Det lader organisationer koble hundredvis af forretningsapps til ét login og ét sted at lukke konti, og store dele af virksomhedsverdenen kører stadig på det."}},"deepDive":{"en":"SAML is an OASIS standard: version 1.0 was approved in November 2002, and SAML 2.0 in March 2005, merging SAML 1.1, the Liberty Alliance ID-FF 1.2 and Shibboleth work. The 2.0 specification set is split into Core (assertions and protocols), Bindings, Profiles, Metadata and conformance documents. An assertion is an XML document issued by an IdP containing a Subject with a NameID (persistent, transient, emailAddress or unspecified format) and SubjectConfirmation data, Conditions (NotBefore, NotOnOrAfter, AudienceRestriction), and statements: an AuthnStatement with AuthnInstant, SessionIndex and an AuthnContextClassRef describing how the user authenticated, and usually an AttributeStatement carrying attributes such as email, groups or employee number.\n\nThe Web Browser SSO profile is what most deployments use. In the SP-initiated variant the service provider creates an AuthnRequest and sends it through the HTTP-Redirect binding (DEFLATE-compressed, base64-encoded, URL-encoded, with any signature carried in query parameters), preserving application state in RelayState. The IdP authenticates the user and returns a Response through the HTTP-POST binding, as an auto-submitting HTML form aimed at the SP's Assertion Consumer Service URL. The Artifact binding instead passes a short reference that the SP resolves over a back channel with SOAP. IdP-initiated SSO sends an unsolicited Response with no InResponseTo to check, which weakens protection against replay and login injection.\n\nSecurity rests on XML Signature. The Response, the Assertion or both carry an enveloped signature whose Reference points to an ID attribute, computed over exclusive canonicalisation. That indirection enables XML Signature Wrapping: Somorovsky and colleagues (\"On Breaking SAML\", USENIX Security 2012) found 11 of 14 frameworks they tested vulnerable to injecting an unsigned assertion next to the signed one. In 2018 Duo Labs showed that XML comments inside a NameID could make several libraries read a truncated identity. A correct SP processes only the element whose signature it verified, checks Destination, Recipient, Audience, validity window with small clock skew and InResponseTo, keeps a replay cache of assertion IDs and disables DTD processing to prevent XXE. EncryptedAssertion with AES-CBC has been broken by chosen-ciphertext attacks, so AES-GCM is preferred. Theft of the IdP's signing key enables Golden SAML forgery.\n\nOperationally, trust is configured by exchanging metadata with entity IDs, endpoints and certificates, and certificate rollovers are a common cause of outages. Single Logout exists but is unreliable across many SPs. SAML suits browser-based enterprise SaaS and is weak for native mobile apps and APIs, where OpenID Connect and OAuth fit better. In Denmark, the OIOSAML profiles (currently 3.0.3 alongside 2.1.0) govern integration with NemLog-in, and the research federation WAYF also builds on SAML.","da":"SAML er en OASIS-standard: Version 1.0 blev godkendt i november 2002, og SAML 2.0 i marts 2005, hvor SAML 1.1, Liberty Alliance ID-FF 1.2 og arbejdet fra Shibboleth blev lagt sammen. Specifikationerne i 2.0 er opdelt i Core (assertions og protokoller), Bindings, Profiles, Metadata og konformitetsdokumenter. En assertion er et XML-dokument udstedt af en IdP med et Subject med et NameID (formaterne persistent, transient, emailAddress eller unspecified) og SubjectConfirmation-data, Conditions (NotBefore, NotOnOrAfter, AudienceRestriction) og udsagn: et AuthnStatement med AuthnInstant, SessionIndex og en AuthnContextClassRef, der beskriver, hvordan brugeren blev autentificeret, og som regel et AttributeStatement med attributter som mail, grupper eller medarbejdernummer.\n\nProfilen Web Browser SSO er den, de fleste bruger. I den SP-initierede variant opretter tjenesteudbyderen en AuthnRequest og sender den via HTTP-Redirect-bindingen (DEFLATE-komprimeret, base64-kodet, URL-kodet, med eventuel signatur i query-parametre), mens applikationens tilstand bevares i RelayState. IdP'en autentificerer brugeren og returnerer et Response via HTTP-POST-bindingen som en HTML-formular, der sender sig selv til SP'ens Assertion Consumer Service-URL. Artifact-bindingen sender i stedet en kort reference, som SP'en slår op over en bagkanal med SOAP. IdP-initieret SSO sender et uopfordret Response uden InResponseTo at kontrollere, hvilket svækker beskyttelsen mod genafspilning og login-injektion.\n\nSikkerheden hviler på XML Signature. Response, Assertion eller begge bærer en enveloped signatur, hvis Reference peger på en ID-attribut og er beregnet over exclusive canonicalization. Den indirekte henvisning muliggør XML Signature Wrapping: Somorovsky m.fl. (\"On Breaking SAML\", USENIX Security 2012) fandt, at 11 af 14 testede rammeværker var sårbare over for at få indsat en usigneret assertion ved siden af den signerede. I 2018 viste Duo Labs, at XML-kommentarer i et NameID kunne få flere biblioteker til at læse en afkortet identitet. En korrekt SP behandler kun det element, hvis signatur den har verificeret, kontrollerer Destination, Recipient, Audience, gyldighedsvindue med lille tolerance for urskævhed og InResponseTo, fører en cache over brugte assertion-id'er mod genafspilning og slår DTD-behandling fra for at forhindre XXE. EncryptedAssertion med AES-CBC er brudt med chosen-ciphertext-angreb, så AES-GCM foretrækkes. Tyveri af IdP'ens signeringsnøgle muliggør Golden SAML-forfalskning.\n\nDriftsmæssigt konfigureres tilliden ved at udveksle metadata med entitets-id'er, endpoints og certifikater, og certifikatskift er en hyppig årsag til nedbrud. Single Logout findes, men er upålideligt på tværs af mange SP'er. SAML passer til browserbaseret SaaS i virksomheder og er svagt til native mobilapps og API'er, hvor OpenID Connect og OAuth passer bedre. I Danmark styrer OIOSAML-profilerne (aktuelt 3.0.3 ved siden af 2.1.0) integrationen med NemLog-in, og forskningsføderationen WAYF bygger også på SAML."},"edges":[{"type":"requires","to":"cs/identity-provider","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/digital-signature","confidence":"high","strength":"normal"},{"type":"implements","to":"cs/federation","confidence":"high","strength":"normal"},{"type":"implements","to":"cs/single-sign-on","confidence":"high","strength":"normal"}],"depth":4,"sources":[{"title":"OASIS - Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0","url":"https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf","tier":"standard","publisher":"OASIS"}],"draft":true}