On this page
What does SAML do?
SAML 2.0 is an open standard for single sign-on between systems. An identity provider signs an XML document that states who the user is, and a service provider trusts that signature instead of running a login of its own.
It is old, it is verbose, and it is not going away. Two decades of enterprise software shipped with SAML support, and for a great many business applications it is still the only federation option on the page.
What is a SAML assertion?
A SAML assertion is a signed XML document that the identity provider creates after the user signs in. The service provider checks the signature, checks the conditions, and starts a local session.
Signature validation is where SAML implementations go wrong. XML lets the same document be read more than one way, so a library that verifies a signature over the wrong element can be fooled. Use a maintained library and do not hand-roll the parsing.
- Issuer: which identity provider produced the assertion.
- Subject and NameID: the identifier the service provider keys the user on.
- Conditions: the validity window and the intended audience.
- Attribute statement: the user attributes released to that service provider.
- Signature: the cryptographic proof over the assertion or the response.
Where do companies use SAML?
SAML is the workforce standard. If your finance system, your HR platform, and your ticketing tool all offer single sign-on, the enterprise plan almost certainly means SAML.
New consumer work rarely starts here, because OIDC is easier to implement in a browser and on mobile. In practice the choice is made for you by what the application already supports.
Workforce single sign-on
One sign-in at the identity provider opens every business application a staff member uses, and one deactivation closes them.
B2B SaaS tenants
A SaaS vendor selling to enterprises is expected to accept the customer's identity provider. SAML is the format most of those buyers bring.
Applications you cannot change
SAML support is often already present in software you bought and cannot modify. That makes it the cheapest path to federation for an older estate.
How does SenseCrypt use SAML?
SenseCrypt is a passwordless identity provider (IdP) from Seventh Sense and acts as a standard SAML 2.0 identity provider. Your service provider consumes an ordinary signed assertion, so the work is metadata exchange and attribute mapping, exactly as with any other IdP.
The difference sits before the assertion is written. The user signs in by face on an enrolled device, with no password and no shared code, so a phishing page has nothing to collect.
Standard metadata exchange
You configure the service provider from SenseCrypt metadata and map the attributes you need. No proprietary connector is involved.
SCIM handles the account lifecycle
SenseCrypt also speaks SCIM 2.0, so provisioning and deprovisioning run next to the sign-in instead of by hand.
Roles released as attributes
SenseCrypt computes group and role membership and releases it to the service provider. Your application decides what each role is allowed to do.
Frequently asked questions
Do companies still use SAML?
Yes. SAML 2.0 remains common for workforce single sign-on (SSO) and B2B SaaS SSO. Many enterprise applications support it.
What is the difference between SAML and OIDC?
SAML uses XML and suits web single sign-on (SSO). OIDC uses JSON and JWTs, and suits modern web and mobile apps.
Does SenseCrypt support SAML 2.0?
Yes. SenseCrypt is a full identity provider (IdP) with SAML 2.0 support. A user signs in by face login.
Related