SAML

SAML, the Security Assertion Markup Language, is an XML-based open standard for exchanging authentication and authorization statements between an identity provider (IdP) and a service provider (SP). Ratified by OASIS, with SAML 2.0 becoming the dominant version in 2005, it is the protocol that made enterprise single sign-on practical: a user authenticates once with a trusted IdP, which issues a signed assertion that any participating application can trust without ever seeing the user’s password.

• Assertions - Signed XML documents carrying statements about who a user is and what they are allowed to do.
• IdP / SP trust model - A pre-established, certificate-backed trust relationship lets the service provider accept the identity provider’s word about a user.
• Single sign-on and federation - One login flows across many applications and even across organizational boundaries.
• Browser-centric flows - SAML rides over HTTP redirects and POSTs, which made it a natural fit for web applications long before token-based APIs were common.

SAML remains deeply entrenched in enterprise identity — most large organizations still gate their SaaS and internal web applications behind a SAML IdP. For API access, though, its XML, browser-redirect design is a poor fit, which is why programmatic and mobile access has largely shifted to OAuth and OpenID Connect. The practical reality I see across providers is a hybrid one: SAML for human web SSO, OAuth-family tokens for machine and API access, and a growing need to reason about both when evaluating how securely and how programmatically an organization actually manages identity.