DE EN IT

~/glossary / Identity & SSO

SAML 2.0

SAML 2.0 (Security Assertion Markup Language) is an XML-based standard in which an identity provider tells an application, with a signature, who has logged in.

daniele@mikweb: ~/glossary — man saml

Flow: the application (SP) redirects the browser to the IdP, the user signs in there, and the IdP posts a signed SAML assertion back through the browser to the application's Assertion Consumer Service (ACS) URL. It contains the NameID and attributes such as email or groups.

Both sides exchange metadata: entity ID, endpoints and the signing certificate. SAML is widespread in enterprise environments; Nextcloud supports it via the user_saml app.

Common errors: an IdP certificate that expired or was rotated without updating the SP, an entity ID that does not match exactly, clock skew beyond the allowed tolerance, and an ACS URL with http instead of https behind a reverse proxy.

Example

https://cloud.example.com/apps/user_saml/saml/metadata
daniele@mikweb: ~/glossary — ls

Related terms

Single sign-on (SSO)Single sign-on (SSO) means users authenticate once at a central service and can then use several applications without entering a password again.Identity provider (IdP)An identity provider (IdP) is the central service that authenticates users and confirms their identity and attributes to applications.Service provider (SP)In SSO, a service provider (SP) is the application that does not authenticate users itself but trusts an identity provider to do so.OpenID Connect (OIDC)OpenID Connect (OIDC) is a login protocol built on OAuth 2.0 that, in addition to access, delivers the user's identity as a signed ID token.

← All terms