How is SAML Beneficial SAML is oft presented as being more complex than X.509 and Username/Password. Mostly, it is that it is newer and hence less well supported and understood. It is more powerful and has long term benefits that will become apparent in this document. SAML can be used in fixed communities, but where SAML comes in to its own is in many to few and scenarios. SAML is particularly suited to scenarios. many to many client polling hub What is a SAML Token? A SAML Token is a relatively small XML document fragment which certifies the identity and attributes of an entity transaction on the internet. In common scenarios, this entity may be a person, a business representative, or a business back end system. SAML Tokens are normally ephemeral. They convey identity for a short period of minutes to hours. They can be used in a number of contexts, from web based single sign on to web services. A SAML normally contains a subject which will be a unique identifier for the entity. It is typically used for tracking and authorisation purposes where the SOAP receiver has its own authorisation database. A SAML token also contains attributes of the entity. In WS-Trust parlance, these attributes are referred to as claims. A claim has a name and a value. Claims typically contain verified information about the entity such as email address. They could contain information such as the DUNS number of a business entity or other common registration number for a particular community. SAML attributes can also contain role information for an entity. A business representative may carry a claim of Purchasing Officer” for example. “Authorised The SAML token has an XML-DSIG signature of a trusted identity provider covering it to certify the validity and correctness of the information contained in the token. When SAML tokens are used in web services, they have a cryptographic key, the Proof Key, which binds the identity of the owner to messages they are sending in the same way that an X.509 Certificate does. Unlike an X.509 Certificate, because SAML tokens are normally relatively short lived and are populated with up to date information at the time they are issued (typically within a few minutes of performing a transaction), there is no need for a revocation mechanism. Based on the sensitivity of a transaction, a token receiver can always reject a token based on authentication event that the token was based on being outside its tolerance.
How is SAML Beneficial SAML is oft presented as being more complex than X.509 and Username/Password. Mostly, it is that it is newer and hence less well supported and understood. It is more powerful and has long term benefits that will become apparent in this document. SAML can be used in fixed communities, but where SAML comes in to its own is in many to few and many to many scenarios. SAML is particularly suited to client polling hub scenarios. What is a SAML Token? A SAML Token is a relatively small XML document fragment which certifies the identity and attributes of an entity transaction on the internet. In common scenarios, this entity may be a person, a business representative, or a business back end system. SAML Tokens are normally ephemeral. They convey identity for a short period of minutes to hours. They can be used in a number of contexts, from web based single sign on to web services. A SAML normally contains a subject which will be a unique identifier for the entity. It is typically used for tracking and authorisation purposes where the SOAP receiver has its own authorisation database. A SAML token also contains attributes of the entity. In WS-Trust parlance, these attributes are referred to as claims. A claim has a name and a value. Claims typically contain verified information about the entity such as email address. They could contain information such as the DUNS number of a business entity or other common registration number for a particular community. SAML attributes can also contain role information for an entity. A business representative may carry a claim of “Authorised Purchasing Officer” for example. The SAML token has an XML-DSIG signature of a trusted identity provider covering it to certify the validity and correctness of the information contained in the token. When SAML tokens are used in web services, they have a cryptographic key, the Proof Key, which binds the identity of the owner to messages they are sending in the same way that an X.509 Certificate does. Unlike an X.509 Certificate, because SAML tokens are normally relatively short lived and are populated with up to date information at the time they are issued (typically within a few minutes of performing a transaction), there is no need for a revocation mechanism. Based on the sensitivity of a transaction, a token receiver can always reject a token based on authentication event that the token was based on being outside its tolerance.