Glossary
SAML 2.0 (Security Assertion Markup Language)
The XML standard for enterprise single sign-on (SSO). A user authenticates with an Identity Provider (IdP: Okta, Azure AD, Keycloak); the IdP returns a signed assertion to a Service Provider (SP: GitLab, Salesforce, your application). The SP trusts the assertion — hence the flaws: assertion without audience, signature wrapping, replay. On the identity side, SAML is the equivalent of OAuth/OIDC on the delegation side.
Frequently asked questions
SAML or OAuth, what is the difference?
SAML is on the identity side (who is the user, signed assertion, enterprise SSO). OAuth/OIDC is delegation + identity via tokens (JWT). In practice: SAML for SSO to enterprise apps, OAuth/OIDC for product integrations.
What is the classic SAML flaw?
An assertion accepted without checking the audience (a token issued for app A is presented to app B), signature wrapping (a valid signature placed around a forged assertion), and replay. In all three cases: the SP verifies the signature but not the destination.