The Gluu Server: the WordPress of IAM

1
 How does SAML work? IDPs SPs

• SAML, or Security Assertion Markup Language, is
  the leading SSO protocol today and is a valuable
  standard to understand in order to fully
  comprehend how SAML OpenID connect works.
•  
• SAML boils down to attribute exchange through the
  creation of trust relationships between IdPs and
  SPs. A basic example is signing into your active
  directory to log on to your work computer in the
  morning, and automatically gaining access to your
  company Gmail or sales force.
•  
• The three main components of the SAML protocol
•  
• Assertions Most common are the following 2 SAML
  assertions
• Authentication assertions are used to make people
  prove their identities.
• Attribute assertions are used to generate
  specific information about the person, for
  example their phone number or email address.
• Protocol This defines the way that SAML asks
  for and gets assertions, for example, using SOAP
  over HTTP.
• Binding This details exactly how SAML message
  exchanges are mapped into SOAP exchanges.

2
5 Benefits of using a SAML IDP   There are many
reasons to use a SAML IdP. Besides being the
dominant single sign on protocol in use today,
there are a host of reasons an organization
should consider implementing a SAML IDP. Here are
5 reasons to use SAML for SSO   1. User
passwords never cross the ?rewall, since user
authentication occurs inside of the ?rewall and
multiple Web application passwords are no longer
required.   2. Web applications with no passwords
are virtually impossible to hack, as the user
must authenticate against an enterprise-class IdM
?rst, which can include strong authentication
mechanisms.   3. SP-initiated two factor
security provides access to Web apps for users
outside of the ?rewall. If an outside user
requests access to a Web application, the SP can
automatically redirect the user to an
authentication portal located at the Identity
Provider.
3
After authenticating, the user is granted access
to the application, while their login and
password remains locked safely inside the
?rewall.   4. Centralized federation provides a
single point of web access management system
software control and auditing, which has
security, risk and compliance bene?ts.   5. A
properly executed identity federation layer that
satis?es all of the use cases described above and
supports multiple protocols can provide an
enterprise-wide, architecturally sound Internet
SSO solution.   Article resource-http//thegluuse
rver.wordpress.com/2014/09/16/how-does-saml-work-i
dps-sps/