What Is SAML? Security Assertion Markup Language, Explained

SAML (Security Assertion Markup Language) is an open, XML-based standard for exchanging authentication data between an identity provider and a service provider. It is one of the main protocols that make single sign-on (SSO) work across separate applications.

The standard is maintained by OASIS, a nonprofit standards body, through its Security Services Technical Committee. SAML 2.0, the version in wide use today, was ratified as an OASIS standard in March 2005 (OASIS). It replaced the earlier 1.x releases and merged in work from the Liberty Alliance and Shibboleth projects.

SAML defines three parties. The principal is the user. The identity provider (IdP) authenticates that user and issues a signed statement called an assertion. The service provider (SP) is the application the user wants to reach; it trusts the assertion and grants access without asking for a password of its own.

In practice, this is what powers "log in with your company account." An employee opening a cloud tool is redirected to the employer's IdP, signs in there, and returns to the tool already authenticated. SAML is especially common in enterprise and business-to-business settings, where many organizations still standardize on it. Newer applications sometimes prefer OpenID Connect, but SAML remains the login method many enterprise buyers ask for by name.

Why it matters for custom software

When a client needs their custom application to join an existing corporate login, SAML is often the protocol their identity provider speaks. We implement it as a service provider so staff reach the software we build through one trusted sign-in, a frequent need in IT and enterprise projects.

This page is a definition, not security advice.