- [Instructor] Modern authentication often
takes place over the web, and the Security
Assertion Markup Language, SAML,
allows browser based single sign-on
across a variety of web systems.
There are three actors in a SAML request.
First there is the end user who
wants to use web based services.
In SAML terms, the end user is known as the principal.
Second there's the organization
providing the proof of identity.
Usually the end user's employer,
school, or other account provider.
This organization is known as the identity provider.
Finally there is the web based service
that the end user wishes to access.
This organization is known as the service provider.
Here's how web based single sign-on works using SAML.
First the end user, principal, requests access
to a resource from the service provider.
The service provider checks to see
if the user already has a logged in session,
and if so, just skips ahead and grants access.
Let's follow the case where the user
is not already logged in, however.
In this case the service provider
redirects the user to the single sign-on
service from the user's identity provider.
The user then tries to authenticate
to the identity provider using a username
and password or other authentication technique.
The key here is that the user must authenticate
directly to the identity provider.
The identity provider then creates an XHTML
form customized for the service provider.
The user then has to use this form
to request what is called a security
assertion from the service provider.
This assertion request includes proof
of identity from the identity provider.
The service provider then validates
the request and creates a security
context with the desired service
and redirects the user to that service.
The user then requests that desired service
and the resource service responds by granting access.
There are two huge benefits to this approach.
First, after the user authenticates
once to the identity provider that authenticated
session may last for a period of time
specified by the identity provider.
During that time period the user does not
need to re-authenticate, providing
a true single sign-on experience.
Second, the service provider may use
the identity provider's authentication
without gaining access to the user's password,
which remains a shared secret
between the user and the identity provider.