Features How It Works Use Cases FAQ Get Access
Enterprise SSO · Federation · Security

The Protocol That
Signs Your Enterprise In.

Deep, practical coverage of SAML — how federation actually works, where real deployments break, and how to run enterprise SSO securely through the long transition ahead.

Harden Your Federation
SAML 2.0 SP-INITIATED · IDP-INITIATED XML SIGNATURES
IDENTITY PROVIDER IdP SERVICE PROVIDER SP 👤 USER BROWSER AuthnRequest Redirect Authenticate SAML ASSERTION SIGNED <saml:Assertion> <Issuer>https://idp.corp.example</Issuer> <Subject>alice@corp.example</Subject> <Audience>https://app.example.com</Audience> /* NotOnOrAfter, Signature, AttributeStatements... */ </saml:Assertion> POST Binding SP VALIDATION CHECKLIST ✓ Signature verified against IdP certificate ✓ Audience restriction matches SP entity ID ✓ Recipient URI matches ACS endpoint ✓ NotOnOrAfter within acceptable window ✗ Missing: XML wrapping defenses ✗ Missing: InResponseTo replay check ! Review: Clock skew tolerance > 5 min ! Review: Certificate rotation schedule 2 critical gaps · 2 review items · 4 passing Run Full Checklist →
0+
Years SAML has been signing enterprise users in
#0
Most common SAML vuln: incomplete assertion validation
0
Validation checks that separate secure from breached federations
0%
Of enterprises managing SAML alongside newer protocols
Deep Coverage

Protocol Clarity Paired with Hard Security Guidance

saml.ms walks through the full SAML landscape: how identity providers and service providers establish trust, how assertions carry identity claims, and exactly where deployments go wrong. It covers the validation steps that prevent assertion forgery, the metadata hygiene that prevents trust hijacking, and places SAML honestly within a modern stack that also includes OIDC and AI agent access.

SP-Initiated SSO IdP-Initiated SSO XML Sig Wrapping Assertion Validation Metadata Hygiene Certificate Rotation OIDC Coexistence B2B Federation Attribute Mapping Replay Protection Clock Skew Trust Anchoring
ASSERTION SECURITY VALIDATION
// Signature verification
<ds:Signature> ← verify against IdP cert
// Audience restriction check
<AudienceRestriction>
  <Audience>https://your.sp.com</Audience>
</AudienceRestriction>
// Time window validation
NotOnOrAfter="2026-06-12T10:15:00Z"
// XML wrapping defense — critical
ID="_a82b…" ← validate ref URI
✓ Signature · Audience · Recipient · Time window
✗ XML wrapping not defended → forgery possible
What's Covered

Six Domains, Zero Handwaving

Every piece of the federation lifecycle, covered with production-grade depth.

🔗
Federation Foundations
Identity providers, service providers, assertions, attributes, and bindings — the moving parts of SAML federation explained clearly, with diagrams of SP-initiated and IdP-initiated flows that show what actually travels across the wire.
🛡️
Assertion Security Deep Dives
The validation checklist that defeats real attacks: signature verification done correctly, audience and recipient checks, conditions and time windows, and defenses against XML signature wrapping — the vulnerability that turns SSO into an open door.
🔐
Metadata and Trust Management
How federation trust is established and maintained — certificate rotation without outages, metadata refresh hygiene, and the operational practices that keep trust anchored where you put it and not where an attacker redirects it.
📋
Provider Integration Guides
Step-by-step federation setup with major identity platforms and common enterprise applications — attribute mapping, role assertion, signing configuration, and the configuration traps unique to each platform written from real integration experience.
⚡
SAML in a Modern Stack
Honest guidance on coexistence: where SAML remains the right tool, where OIDC is the better fit, and how to run both during the long enterprise transition — plus what AI agent-based access means for legacy federation infrastructure.
🔍
Troubleshooting Playbooks
Decode failed assertions, clock-skew mysteries, certificate mismatches, and attribute mapping failures with structured diagnostic guides written from production scar tissue — not from the spec, but from the things that actually break.
How It Works

From Protocol Basics to a Hardened, Future-Ready Federation

🧠
Step 01
Understand
Build a working mental model of federation: who asserts identity, who consumes it, and what travels in between — across both flow types.
🔌
Step 02
Integrate
Follow provider-specific guides to connect applications correctly — attribute mappings, signing configuration, and all the details that matter at setup time.
🛡️
Step 03
Harden
Apply the assertion validation and metadata hygiene checklists that separate secure federations from breached ones — before an audit finds the gaps.
🚀
Step 04
Evolve
Plan SAML's place in your future stack — coexisting with OIDC, feeding zero-trust policies, and adapting as AI agents enter the access picture.
Use Cases

What saml.ms Helps You Run Correctly

Workforce SSO
Enterprise SSO That Holds Up
Federate your workforce into hundreds of applications with assertions that are validated rigorously — so single sign-on is a convenience for users and not a single point of compromise waiting to be exploited.
Legacy Applications
Securing Legacy Application Access
Bring older enterprise applications that only speak SAML under the same identity governance as the rest of the stack, instead of leaving them as ungoverned islands on the edge of your security perimeter.
B2B Federation
Auditable Partner Federation
Establish cross-organization federations with clean metadata management and explicit attribute contracts, so partner access is scoped, reviewable, and governed — not a trust relationship that nobody remembers establishing.
Who It's For

Built for the Teams Who Keep Enterprise SSO Standing

✓
IAM Engineers Running production federations across dozens of applications, needing depth that goes beyond the happy path in vendor documentation.
✓
Security Teams Auditing SSO implementations for assertion-level weaknesses before attackers find the missing validation checks.
✓
Identity Architects Planning the long SAML-to-OIDC coexistence realistically — not a clean cutover, but a managed transition that takes years.
✓
Application Teams Integrating with enterprise identity for the first time, who need to get federation right without becoming SAML experts by accident.
SAML's Maturity Is Both Its Strength and Its Risk
SAML is everywhere — and old enough that dangerous misconfigurations have had decades to spread. A federation that skips one validation step can accept a forged assertion, which means an attacker signs in as anyone, to everything.

As enterprises layer AI agents and zero-trust policies onto identity infrastructure largely held up by SAML, getting the foundation right is not nostalgia. It is load-bearing security work that determines whether the modern stack is trustworthy — or just modern-looking.
"Trust the assertion. Verify everything."
FAQ

Common Questions

Is SAML obsolete now that OIDC exists? ▾
No. OIDC is the default for new consumer and API-centric builds, but SAML remains deeply embedded in enterprise applications and B2B federation. The realistic posture for most organizations is secure coexistence for years — which is exactly what saml.ms helps you run correctly.
What is the single most common SAML vulnerability? ▾
Incomplete assertion validation — especially signature verification that can be bypassed through XML signature wrapping, and missing audience or recipient checks. These failures keep appearing in real audits because the SAML spec makes it easy to implement partial validation that looks correct until it isn't.
SP-initiated or IdP-initiated SSO — which should we prefer? ▾
Prefer SP-initiated where possible: it gives the service provider control of the flow and reduces exposure to unsolicited assertions. IdP-initiated has legitimate uses — deep links, portal launches — but demands extra care around replay and CSRF protections that many implementations skip.
How does SAML relate to AI agents accessing enterprise apps? ▾
Mostly indirectly: agents typically authenticate with modern token-based protocols, but they frequently need access to enterprise applications that still federate via SAML. Understanding both sides — and the governance gap at the seam between them — is how you avoid leaving agent access ungoverned by default.

The Enterprise Still Runs on SAML. Run It Securely.

Single sign-on is only as strong as the assertions behind it. saml.ms gives identity teams the protocol depth, security checklists, and operational playbooks to keep enterprise federation trustworthy — today, and through the long transition ahead.

Run the Hardening Checklist