Trials and demos
How to buy

What is SAML? How single sign-on authentication works

Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between an identity provider and a service provider. In plain terms, SAML lets a trusted identity provider tell an application that a user is who they claim to be, so the user can sign in once and access multiple applications without re-entering credentials.

SAML is the protocol that makes web-based single sign-on (SSO) possible. This page explains what SAML does, how a SAML login works, and how it compares to related standards such as OAuth and OIDC.

Five Key Factors for Simpler, More Secure SSO

    What does SAML do?

    Before standards like SAML, every application managed its own logins, so users juggled separate passwords for each one and IT teams managed credentials in many places. SAML solves this by delegating authentication to a single trusted identity provider. The user authenticates once with that provider, which then vouches for the user's identity to each connected application. This is the foundation of federated identity and web-based single sign-on: fewer passwords for users, centralized control for IT, and credentials that are never exposed to every individual app.

    SAML is defined by the OASIS SAML specification, maintained by the OASIS standards body, which is the authoritative technical source for the standard. The U.S. National Institute of Standards and Technology also addresses federated authentication in NIST Special Publication 800-63C (Digital Identity Guidelines: Federation and Assertions).

    The three parties in a SAML flow

    A SAML login involves three parties:

    • User — the person trying to access an application.
    • Identity provider (IdP) — the trusted service that authenticates the user and issues identity information.
    • Service provider (SP) — the application the user is trying to reach, which trusts the identity provider.

    The identity provider and service provider establish trust in advance, so the application accepts the identity provider's word that the user is authenticated.

    How does SAML work in practice?

    In practice, a SAML login works like this:

    1. The user tries to access an application (the service provider).
    2. The service provider redirects the user to the identity provider to authenticate.
    3. The user signs in at the identity provider (which may also require multi-factor authentication).
    4. The identity provider sends a signed SAML assertion back to the service provider, confirming the user's identity.
    5. The service provider trusts the assertion and grants access — no additional password required.

    These redirects happen quickly in the browser, so the user experiences a single, smooth sign-in.

    The Basics of SAML

    What are the benefits of SAML?

    SAML simplifies login experiences for users, strengthens security, and reduces costs and complexity for service providers. People can securely re-use the credentials they already have for many different applications.

    What role do users play in SAML?

    The SAML process is briefly visible to users through web browser redirects, but they do not have to configure or manage anything. Because SAML happens behind the scenes, users can just enjoy the simplified login experience it provides.

    How do service providers use SAML?

    Service providers offer the applications that users want to access. They configure their applications to establish and trust SAML connections through one or more identity providers.

    What do identity providers do?

    Identity providers handle authentication requests and pass identity and authorization information back to service provider applications. The Cisco Security Technology Alliance program includes several third-party identity providers.

    Does SAML support multi-factor authentication?

    Yes, technologies like Duo multi-factor authentication and Duo single sign-on work together to simplify and secure the login experience through SAML.

    SAML vs OAuth vs OIDC

    StandardPrimary use caseAuthentication vs authorizationTypical deployment
    SAMLWeb-based single sign-on for enterprise and B2B applicationsPrimarily authentication (also carries authorization attributes)Enterprise SSO, often on-premises or hybrid; XML-based
    OAuth 2.0Delegated authorization, granting an app limited access to resources on a user's behalfAuthorization (not authentication on its own)APIs and mobile/web apps; token-based
    OIDC (OpenID Connect)Authentication layer built on top of OAuth 2.0Authentication (adds identity to OAuth)Modern web and mobile apps; JSON/REST-based

    SAML and OIDC both handle authentication; OAuth on its own handles authorization. SAML is common in established enterprise environments, while OIDC is common in newer, API-driven applications. For deeper detail on OAuth and OIDC, see the related pages.

    Where is SAML used?

    SAML is most common in:

    • Enterprise single sign-on — giving employees one login for many internal and cloud applications.
    • B2B federation — letting partner organizations grant their users access to shared applications without creating separate accounts.
    • SaaS application access — connecting workforce identities to third-party cloud services.

    Common questions about SAML

    SAML stands for Security Assertion Markup Language. It is an XML-based open standard, maintained by the OASIS standards body, for exchanging authentication and authorization data between an identity provider and a service provider. In practice, SAML lets users sign in once and access multiple applications without re-entering their credentials.

    SAML is the protocol that makes web-based single sign-on possible. A trusted identity provider authenticates the user once and then asserts that identity to each connected application, so the user does not log in separately to each one. Single sign-on lets people sign into multiple applications, both cloud-based and on-premises, while entering their login credentials only once.

    A SAML assertion is the statement an identity provider sends to a service provider that contains authentication, attribute, or authorization decision information. For example, a SAML assertion can give a service provider either a Yes (authenticated) or No (authentication failed) response about a user.

    A SAML token is an XML-formatted document that contains the claims, or SAML assertions, that one entity makes about another. For example, an identity provider can assert that a user is who they say they are. A security token service digitally signs the SAML token as proof to the service provider.

    Identity federation is the process of delegating authentication responsibility to trusted identity providers. SAML and similar technologies, such as OAuth and Web Services Federation (WS-Fed), rely on identity federation to securely re-use existing credentials across multiple applications.

    SAML is primarily used for authentication - confirming who a user is - most often for enterprise single sign-on. OAuth is used for authorization - granting an application limited access to resources on a user's behalf. They solve different problems and are often used in different contexts.

    Lightweight Directory Access Protocol (LDAP) is an open standard for accessing directory information over an IP network. While SAML and LDAP are both authentication protocols, they work differently and serve different purposes: LDAP is often used for on-premises authentication, while SAML extends user credentials to cloud applications.

    Yes. SAML remains widely deployed for enterprise and B2B single sign-on, especially in established environments. Newer applications often use OpenID Connect (OIDC), but SAML continues to be a core standard for federated identity.

    Resources

    Learn more about SAML

    Learn more about Duo Duo multi-factor authentication Duo single sign-on Duo Single Sign-On for Generic SAML Service Providers

    Related security topics

    What is multi-factor authentication (MFA)? Cybersecurity Maturity Model Certification (CMMC) What Is Supply Chain Risk Management (SCRM)? What is a user authentication policy? What is identity access management (IAM)? What is single sign-on (SSO)?