{"id":17463,"date":"2024-01-19T09:57:52","date_gmt":"2024-01-19T14:57:52","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=17463"},"modified":"2024-01-19T10:04:09","modified_gmt":"2024-01-19T15:04:09","slug":"demystifying-saml-authentication-a-look-at-the-role-of-saml-in-sso-based-access-management","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/demystifying-saml-authentication-a-look-at-the-role-of-saml-in-sso-based-access-management\/","title":{"rendered":"Demystifying SAML Authentication: A Look at the Role of SAML in SSO-Based Access Management\u00a0"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-we-ll-break-down-xml-and-pki-rooted-saml-authentication-and-its-role-in-single-sign-on-technologies-used-by-authentication-tools-like-okta-duo-etc-in-layman-s-terms\">We\u2019ll break down XML- and PKI-rooted SAML authentication and its role in Single Sign-On technologies (used by authentication tools like Okta, Duo, etc.) in layman\u2019s terms&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SAML, or Security Assertion Markup Language, is a foundational element of single sign-on (SSO) tools. SSO technology is convenient and easy to use; it serves as a centralized point of authentication that users authenticate to (typically in the form of a user portal). Once a user is authenticated, they\u2019ll have access to all the apps and tools they\u2019re authorized to use via a centralized dashboard.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, <a href=\"https:\/\/www.login.gov\/\" target=\"_blank\" rel=\"noreferrer noopener\">Login.gov<\/a> is the SSO service used by U.S. government agencies that enables users to create one single account that gives them access to services from multiple partner agencies. It allows application developers to <a href=\"https:\/\/developers.login.gov\/\" target=\"_blank\" rel=\"noreferrer noopener\">choose between using SAML or the OpenID Connect (OIDC)<\/a> as the implementation protocol.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From a user\u2019s perspective, SSO is almost akin to magic. For them, it means no more mucking about with multiple usernames and passwords. Users no longer must log in to separate services. From an admin\u2019s perspective, it\u2019s more secure than having users juggle multiple login credentials and log in through separate third-party web apps that may not be secure.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">All of this brings us back to our original question: where does SAML authentication fit in? What makes SAML a secure underlayment for SSO? And how can you integrate SAML and SSO within your business?&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n\n<div class=\"wp-block-advanced-gutenberg-blocks-notice is-variation-info has-icon\" data-type=\"info\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"12\" r=\"10\"><\/circle><line x1=\"12\" y1=\"16\" x2=\"12\" y2=\"12\"><\/line><line x1=\"12\" y1=\"8\" x2=\"12\" y2=\"8\"><\/line><\/svg><p class=\"wp-block-advanced-gutenberg-blocks-notice__title\">TL;DR?<\/p><p class=\"wp-block-advanced-gutenberg-blocks-notice__content\">Catch the highlights in our <a href=\"#tldr\">TL;DR overview section<\/a> toward the end of the article.<\/p><\/div>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12753\"><\/span>\n\n\n<h2 class=\"wp-block-heading\">SAML = Security Assertion Markup Language&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In short, SAML is a widely adopted open standard and authentication protocol that enables two parties to securely exchange digital identity and authentication-related data. It is used to facilitate secure authentication as a primary focus.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SAML authentication aims to provide a secure, user-friendly experience by:&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Securely transmitting sensitive user data via public key cryptography, and&nbsp;&nbsp;<\/li>\n\n\n\n<li>Eliminating multiple login credentials and sign-in processes in exchange for a single sign-on functionality.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">SAML was created by the <a href=\"https:\/\/www.oasis-open.org\/committees\/tc_home.php?wg_abbrev=security\" target=\"_blank\" rel=\"noreferrer noopener\">OASIS Open standards consortium\u2019s Security Services Technical Committee<\/a>. (OASIS stands for Organization for the Advancement of Structured Information Standards.) This framework is based upon Extensible Markup Language (XML) and relies on <a href=\"https:\/\/www.thesslstore.com\/blog\/public-key-cryptography-key-exchange\/\" target=\"_blank\" rel=\"noreferrer noopener\">public key cryptography<\/a> (and its underlying <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-pki-a-crash-course-on-public-key-infrastructure-pki\/\" target=\"_blank\" rel=\"noreferrer noopener\">public key infrastructure [PKI]<\/a>) to securely communicate that sensitive data. (More on that in just a moment.)&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A few versions of the SAML standard have been around since <a href=\"https:\/\/www.oasis-open.org\/standards#samlv1.0\" target=\"_blank\" rel=\"noreferrer noopener\">November 2002<\/a>. (SAML 1.0 in 2002, SAML 1.1 in 2003, etc.) The most recent version, SAML 2.0, came out a few years later in 2005; it\u2019s been in use ever since.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check out this video from VMWare. It takes a closer look under the hood at how SAML authentication initiates and delves more into the nitty-gritty of how it works:&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"SAML 2.0: Technical Overview\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/SvppXbpv-5k?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">PKI and SAML Play Nicely Together&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SSO and SAML help to provide a single point of authentication via a trusted identity provider. The security of SAML 2.0 authentication&nbsp;is founded on <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-pki-a-crash-course-on-public-key-infrastructure-pki\/\" target=\"_blank\" rel=\"noreferrer noopener\">public key infrastructure (PKI)<\/a>, the bedrock that internet security itself is built upon. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SAML is a standard that uses PKI digital certificates for the purpose of authenticating users\u2019 digital identities. (This helps systems verify that a user signing into their service really is the legitimate user and not someone impersonating him or her.)&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SAML uses PKI-based <a href=\"https:\/\/www.w3.org\/TR\/xmldsig-core\/\" target=\"_blank\" rel=\"noreferrer noopener\">XML digital signatures<\/a> for assertions, which are created using the signer\u2019s private key and verified using their public key, and attribute encryption using XML encryption.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although some SSO vendors allow you to get away with using self-signed client authentication certificates, many require you to use publicly trusted certificates instead.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Is SAML perfect? Nah. No protocol or standard is perfect; there\u2019s always the potential for vulnerabilities, particularly if something isn\u2019t implemented properly. (Some systems and processes also just happen to be buggier than others!) As such, there\u2019s always room for improvements to be made.&nbsp;&nbsp;<\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12653\"><\/span>\n\n\n<h3 class=\"wp-block-heading\">SAML vs OIDC: What\u2019s the Difference?&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019ve at least heard of SAML, then it\u2019s likely that you\u2019ve also heard of OpenID Connect. OIDC is a less complex protocol that\u2019s based on the <a href=\"https:\/\/oauth.net\/2\/\" target=\"_blank\" rel=\"noreferrer noopener\">OAuth 2.0 Framework<\/a>.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In some aspects, OpenID Connect was intended to be the successor to SAML because its standards are used by many commercial organizations. However, many larger enterprises still prefer to rely on SAML.&nbsp;While both are considered identity protocols, there are differences in terms of their uses and underlying mechanisms. For example, SAML uses XML assertions (more on those in a bit), whereas OIDC uses JSON web tokens (JWTs). &nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Does SAML Do?&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In a nutshell, SAML lays the technical groundwork that enables users (called <strong>Subjects<\/strong> or <strong>Principals<\/strong>) to authenticate using SSO tools. The SAML open standard provides the foundation for the communications that take place primarily between two main parties:&nbsp;&nbsp;<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"1\">\n<li><strong>A trust store (also known as an identity provider [IDP]).<\/strong> Examples of such IDPs would be Okta (although, technically, this can also be used as a service provider), Duo, JumpCloud, etc.&nbsp;&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li><strong>The service provider (SP) whose app or service the user wants to access.<\/strong> Examples of a couple of service providers could be your company\u2019s HR app, a communication tool like Zoom, a project management tool like JIRA, and your email client.&nbsp;&nbsp;<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">A third party involved is the user\u2019s browser \u2014 this is called a <strong>web client<\/strong> or <strong>user agent<\/strong>. Many of the metadata exchanges that take place between the IDP and SP go through this third party.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are two key transactions that take place between multiple systems and entities when engaging SSO with SAML:&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. SAML Requests&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When the SP sends a communication to the IDP, it\u2019s called a <strong>SAML Request<\/strong>. This occurs when an authenticated user tries to sign in to authenticate and access a service provider\u2019s dashboard, service or app. This message generally contains information about the user (in the form of a character-string ID), specifies how the data should be formatted, and provides additional information.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. SAML Responses&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now, let\u2019s consider what happens when the IDP responds to the SP. This message is called a <strong>SAML Response<\/strong>. These messages are sent to the SP\u2019s Assertion Consumer Service, whose job it is to process them.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SAML Responses contain several important pieces of data:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Several digitally signed and encrypted statements about the user\u2019s identity, which are called <a href=\"https:\/\/pages.nist.gov\/800-63-4\/sp800-63c\/assertions\/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Assertions<\/strong><\/a>,&nbsp;&nbsp;<\/li>\n\n\n\n<li>Other key user identification values that are contained within assertions are called <strong>Attributes<\/strong> (first name, last name, username, etc.). These also can be digitally signed and encrypted.&nbsp;&nbsp;<\/li>\n\n\n\n<li><strong>Conditions<\/strong> that specify a validity period for the SAML Response (i.e., specific \u201cNotBefore\u201d and \u201cNotOnOrAfter\u201d date and time constraints).&nbsp;<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Both SAML assertions and COID tokens must be secure. In this case, they use different forms of encryption. <a href=\"https:\/\/pages.nist.gov\/800-63-4\/sp800-63c\/assertions\/\" target=\"_blank\" rel=\"noreferrer noopener\">According to NIST<\/a>:&nbsp;<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><em><em>&#8220;<\/em>When personally-identifiable information is included in the assertion and the assertion is handled by intermediaries such as a browser, the federation protocol\u202f<\/em><strong><em>SHALL<\/em><\/strong><em>\u202fencrypt assertions to protect the sensitive information in the assertion from leaking to unintended parties. For example, a SAML assertion can be encrypted using XML-Encryption, or an OpenID Connect ID Token can be encrypted using JSON Web Encryption (JWE).\u201d<\/em>&nbsp;&nbsp;<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/developer.signicat.com\/broker\/signicat-identity-broker\/service-providers\/saml\/saml-examples.html\" target=\"_blank\" rel=\"noreferrer noopener\">Check out Signicat\u2019s page<\/a> to learn more about the formatting and to see examples of SAML Request and SAML Response examples.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How SAML Authentication Works in Single-Sign On&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To better understand how this works, let\u2019s consider a couple of example scenarios of SAML authentication, using your organization as an example. Imagine that one of your employees wants to use one of the apps that\u2019s available in their employee portal.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One option is to go to the service provider\u2019s website directly and login there by setting up yet another unique username and password (one of about <a href=\"https:\/\/nordpass.com\/blog\/discover-family-plan\/\" target=\"_blank\" rel=\"noreferrer noopener\">100 passwords NordPass says the average user has to continually manage<\/a>). This non-SAML process involves a user entering those credentials, which involves the web app looking up their individual usernames in a database, hashing their password, and seeing if it matches what\u2019s stored for that user.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then, if the user wants to use another authorized application, they\u2019ll have to rinse and repeat the process with that separate vendor or application.&nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, they can attempt to initiate SAML authentication once, in one of two ways, using SSO:&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><\/strong>&nbsp;<\/td><td><strong>Scenario #1: Service Provider Initiated (Also Called SP Initialized) SSO<\/strong>&nbsp;<\/td><td><strong>Scenario #2: Identity Provider Initiated (Also Called IDP Initialized) SSO<\/strong>&nbsp;<\/td><\/tr><tr><td>What the User Wants to Achieve&nbsp;<\/td><td>An authorized user wants to connect to their company\u2019s HR app to put in a leave request.&nbsp;&nbsp;<\/td><td>An authorized user wants to connect to the trust store directly to streamline the authentication process.&nbsp;&nbsp;<\/td><\/tr><tr><td>How the User Accesses the App&nbsp;<\/td><td>The user initiates communication with the Service Provider (SP) directly via their browser.&nbsp;&nbsp;&nbsp;The user signs into the service provider\u2019s system or application using a traditional username-password combination.&nbsp;&nbsp;<\/td><td>The user authenticates directly with the Identity Provider (IDP) using their login credentials via their browser.&nbsp;&nbsp;&nbsp;(<strong>NOTE: <\/strong>This SAML Request step doesn\u2019t exist in this scenario.)&nbsp;&nbsp;<\/td><\/tr><tr><td>A Look at What Happens Behind the Scenes (1 or 2 Steps)&nbsp;<\/td><td><strong>Step One:<\/strong> The browser\u2019s action triggers the SP to send an unauthenticated SAML Request to the Identity Provider (IDP) via the web client.&nbsp;&nbsp;&nbsp;<strong>Step Two:<\/strong> IDP sends a login URL to the browser and has the user sign in via their login credentials. The IDP parses the request and authenticates the user.&nbsp;&nbsp;&nbsp;<strong>Step Three:<\/strong> The IDP then creates a session and sends a message (SAML Response) to the SP via their browser.&nbsp;<\/td><td><strong>Step One:<\/strong> In response to the browser\u2019s prompt, the IDP sends a SAML Response message to the Service Provider (SP) or App the User Is Trying to Access.&nbsp;&nbsp;&nbsp;The IDP informs the SP that the user\u2019s credentials are valid.&nbsp;<\/td><\/tr><tr><td>The Final Result&nbsp;<\/td><td>If the user\u2019s digital identity is successfully verified, they\u2019ll be logged in and can access the authorized digital resources.&nbsp;&nbsp;<\/td><td>The user, once authenticated, will be logged in and can access the authorized digital resources.&nbsp;&nbsp;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s a basic overview at how both of these scenarios play out:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"886\" height=\"346\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image.png\" alt=\"A graphic that shows a simplified version of the process involved in SP-initiated SSO. \" class=\"wp-image-17466\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image.png 886w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image-300x117.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image-768x300.png 768w\" sizes=\"auto, (max-width: 886px) 100vw, 886px\" \/><figcaption class=\"wp-element-caption\"><em>Image caption: A simplified illustration that demonstrates the general concept of how SP-initiated single-sign-on works.&nbsp;<\/em>&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In SP-initiated SSO, the user will try to access the app directly using their browser. That app will reach out to the IDP to ensure the user is who they say they are. Once their identity has been verified and they\u2019ve been authenticated, their browser will be directed to the app.&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"886\" height=\"346\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image.png\" alt=\"A graphic that shows a simplified version of the process involved in IDP-initiated SSO. \" class=\"wp-image-17465\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image.png 886w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image-300x117.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/image-768x300.png 768w\" sizes=\"auto, (max-width: 886px) 100vw, 886px\" \/><figcaption class=\"wp-element-caption\"><em>Image caption: A basic illustration that simplifies the general idea of how IDP-initiated single-sign-on works.&nbsp;<\/em>&nbsp;&nbsp;<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">With IDP-initiated SSO, as far as they user is concerned, they\u2019ll simply enter their login credentials, and something (unseen) will happen in the background that gives them access to the company\u2019s email client, JIRA, or whatever other digital tools and services they\u2019re authorized to use.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To the user, it\u2019s practically magic, but after reading this article, you now know better. &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which Approach to SAML Authentication Should You Use?&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The answer to that question is the dreaded response everyone hates to get: \u201cit depends.\u201d But the reason we say that is that there are <a href=\"https:\/\/www.thesslstore.com\/blog\/single-sign-on\/\">pros and cons to both methods for SSO<\/a>, and it also varies based on how you have systems set up within your organization.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What we will say is that commercial applications often use SP-initiated SSO. However, it\u2019s also common in SaaS scenarios to use IDP-initiated SSO because it streamlines the process by removing a step.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As such, the answer of whether to use SP-initiated or IDP-initiated varies depending on your organization. So, do your research to figure out what works best for your specific needs.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"tldr\">TL;DR: The Highlights of SAML Authentication in 20 Seconds&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Security Assertion Markup Language (SAML) authentication is both the framework and protocol that has served as the foundation for most single sign-on (SSO) technologies for the past ~20 years. SAML authentication:&nbsp;&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Facilitates secure user authentication. &nbsp;<\/li>\n\n\n\n<li>Streamlines the authentication process in SSO (i.e., enables users to authenticate once at a central point and enjoy the benefits of being able to access all of the tools or services they\u2019re authorized to use).&nbsp;<\/li>\n\n\n\n<li>Relies on public key cryptography (and its roots in PKI) to digitally sign and encrypt SAML assertions.&nbsp;&nbsp;<\/li>\n\n\n\n<li>Provides greater security by having users authenticate using a trusted identity provider.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Final Takeaways on SAML Authentication&nbsp;&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As we\u2019ve learned, SAML is a trusted framework that many businesses the world over rely on for transmitting sensitive and private user data for SSO. Using public key cryptography, it lays the groundwork for securely communicating attributes and personal identifying data between service providers and identity providers.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We hope you\u2019ve found this information informative and useful. If you have additional thoughts or insights to share, we invite you to do so in the comments below. &nbsp;&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We\u2019ll break down XML- and PKI-rooted SAML authentication and its role in Single Sign-On technologies (used by authentication tools like Okta, Duo, etc.) in layman\u2019s terms&nbsp; SAML, or Security Assertion&#8230;<\/p>\n","protected":false},"author":17,"featured_media":17468,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[13264],"class_list":["post-17463","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-saml-authentication","post-with-tags"],"views":10713,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2024\/01\/saml-authentication-in-sso-feature.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/17463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=17463"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/17463\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/17468"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=17463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=17463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=17463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}