Click here to Skip to main content
12,701,314 members (33,484 online)
Click here to Skip to main content
Add your own
alternative version


29 bookmarked

Security Assertion Markup Language (SAML2.0)

, 22 Jun 2009 CPOL
Rate this:
Please Sign up or sign in to vote.


SAML is an XML based framework used by business entities or partners to share the authentication, attribute, and entitlement information about an entity. An entity can be termed as an end user who has some business dealings with these business partners or it can be a business partner or application.


To get the technical overview of SAML, just go through this link.


SAML can be used in the following three scenarios:

  1. Single Sign On(SSO): SAML is specially used to solve the multidomain problem. For example, a user has an account with and, where these two are business partners. With a single sign on facility, the user has to login just once on the Web site and he will be able to access resources from both the Web sites. Sharing authentication information is fairly simple as SAML provides independent grammar and protocol to share information from one server domain to the other domain.
  2. Federated Identity: As maintaining identity information for each of the services that a user is subscribed to is a tedious process, SAML solves this problem by providing grammar to establish a identity known as federated identity. This is a shared name identifier used to refer to an end user or an entity who is using the services offered by various partners.
  3. Web Service Security: SAML also provides a facility to secure the Web services. This is done by using SAML assertion in the soap header to transmit the information which is not possible using other security formats.

Read about SAML Protocols and Assertions here.

Using the Code

Before you start any programming on SAML, all you need is a set of protocols and assertions which you can use for any of the scenarios discussed above. I have been using SAML2.0 for generating federated Identity.

To generate the assertions and protocols, all you need is schema definitions to generate the code. You can get SAML 2.0 schemas from this link. I am uploading the .NET class library project which contains Protocols and Assertions Classes (Core), and also all the schema files and documents. Please go though the SAML documents for the usage.

Use Xsd.exe provided in Visual Studio to generate the code. An example is given below:

// C#
// xsd SAMLSchema.xsd /language:CS

Note that you need to provide all dependant schemas in order to generate a full set of SAML protocols and assertions classes. These classes are serializable to XML.

Binding the SAML Assertions and protocols: One important issue with these assertions and protocols used in SAML is on the wire they should be represented as it is. SAML binding defines how SAML assertions and protocols can be embedded in standard communication protocols. For more information, go through this link.

Test Case Scenario

The entity which provided federated Identity for the user is called the Asserting party, which makes assertions also called as SAML authority. The entity which consumes these assertions is called as the Relying party. Here wants to generate a federated identity for the user (with the consent of the user) with So generated a SAMLAuthentication request and sends it to to generate a external identity. generated SAMLAuthentication response and sends it to This response contains Assertions from which a NameIdentifier can be retrieved. I am using HTTPhandlers on both sides to handle this scenario. I use HTTPPost to send a request and receive a response on the wire.

The SAML authentication request inside a soap envelope is as follows:

 <env:Envelope xmlns:env="">

  <SOAP:Body xmlns:SOAP="">

 <samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"


 ID="RlFme3cd9ThZVDg6a8Yqjg" Version="2.0" IssueInstant="2007-04-04T22:50:32.0860086Z"
Destination="http:://" ForceAuthn="false" IsPassive="false"


  <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistant" 
        AllowCreate="true" />
  <saml:Conditions NotBefore="2007-04-04T22:40:32.0860086Z" 
        NotOnOrAfter="2007-04-04T23:00:32.0860086Z" />
 <samlp:RequestedAuthnContext Comparison="minimum">
 <Signature xmlns="">

  <CanonicalizationMethod Algorithm="" />

  <SignatureMethod Algorithm="" />

 <Reference URI="#RlFme3cd9ThZVDg6a8Yqjg">
  <Transform Algorithm="" />

  <Transform Algorithm="" />

  <DigestMethod Algorithm="" />


SAML Authentication response in soap envelope is as follows:

 <soapenv:Body xmlns:soapenv="">

 <samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

xmlns:xsd="" ID="_od8zwzNH4shfrUGeewHng"

InResponseTo="RlFme3cd9ThZVDg6a8Yqjg" Version="2.0"


  <samlp:StatusCode Value="Success" />
  <samlp:StatusMessage>Valid User</samlp:StatusMessage>
 <saml:Assertion Version="2.0" ID="1DNDh3_IC7KkVwbffd07Jw" 

  <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistant">
  <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer" />
 <saml:Conditions NotBefore="2007-04-04T22:49:52.4172846Z" 

 <saml:AuthnStatement AuthnInstant="2007-04-04T22:51:52.4485176Z"
 <Signature xmlns="">

  <CanonicalizationMethod Algorithm="" />

  <SignatureMethod Algorithm="" />

 <Reference URI="#1DNDh3_IC7KkVwbffd07Jw">
  <Transform Algorithm="" />

  <Transform Algorithm="" />

  <DigestMethod Algorithm="" />


Hope this will help in getting a good understanding of the SAML language for all those who are interested in SAML.

Points of Interest

Just want to say that if you want to adapt to the independent user or entity information sharing across different domains, then SAML is the best choice of all the identity management models available.

If you have any questions or comments, please email me.


  • 5th May, 2007: Initial post
  • 22nd June, 2009: Updated article and added project zip file 


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Mohan Pindyala
Software Developer (Senior) Rovi Corporation
United States United States
Working on web services , Web services security , SAML2.0,WSE, WCF and Ajax Applications .

You may also be interested in...


Comments and Discussions

Questiondownload not complete Pin
Code10813-Jan-16 13:16
memberCode10813-Jan-16 13:16 
Questionhow to get saml authentication request Pin
deepikashr@gmail.com3-Jun-14 23:30
memberdeepikashr@gmail.com3-Jun-14 23:30 
QuestionQuestion on Signature in the Response Pin
anusha katam29-Jul-13 18:11
memberanusha katam29-Jul-13 18:11 
Question[My vote of 1] Poor at best Pin
VB_Gone-Wild1-Oct-12 3:51
memberVB_Gone-Wild1-Oct-12 3:51 
QuestionSAML Asssertion File from XSD Schema. Pin
Rambhopal1-Sep-11 4:13
memberRambhopal1-Sep-11 4:13 
QuestionReading SAML response Pin
satya R chappidi25-Jan-11 9:50
membersatya R chappidi25-Jan-11 9:50 
GeneralVery Poor Article Pin
capdragon7-Jan-11 5:02
membercapdragon7-Jan-11 5:02 
GeneralMy vote of 1 Pin
capdragon7-Jan-11 4:59
membercapdragon7-Jan-11 4:59 
GeneralReal world SAML Pin
ComponentSpace1-Dec-10 21:20
memberComponentSpace1-Dec-10 21:20 
GeneralMy vote of 1 Pin
Seanlm7630-Aug-10 3:45
memberSeanlm7630-Aug-10 3:45 
GeneralHTTP post Pin
jharkness30-Mar-10 10:08
memberjharkness30-Mar-10 10:08 
GeneralRe: HTTP post Pin
Mohan Pindyala30-Mar-10 17:06
memberMohan Pindyala30-Mar-10 17:06 
Questionhow to pass user credential(usr/passwd) to IDP using HTTP post Pin
hvap24-Sep-09 10:37
memberhvap24-Sep-09 10:37 
AnswerRe: how to pass user credential(usr/passwd) to IDP using HTTP post Pin
Mohan Pindyala29-Sep-09 9:17
memberMohan Pindyala29-Sep-09 9:17 
GeneralMy vote of 1 Pin
Member 432889323-Aug-09 23:42
memberMember 432889323-Aug-09 23:42 
GeneralAssistance on SAML2.0 using weblogic 10.3 Pin
Ajitkumarbehera1-Aug-09 18:25
memberAjitkumarbehera1-Aug-09 18:25 
Questionwhats the big deal? Pin
spyhunter99927-Jun-09 3:56
memberspyhunter99927-Jun-09 3:56 
AnswerRe: whats the big deal? Pin
Mohan Pindyala27-Jun-09 8:17
memberMohan Pindyala27-Jun-09 8:17 
GeneralRe: whats the big deal? Pin
spyhunter99927-Jun-09 11:03
memberspyhunter99927-Jun-09 11:03 
Questionis this article damaged? Pin
adamspe15-Jun-09 6:41
memberadamspe15-Jun-09 6:41 
AnswerRe: is this article damaged? Pin
Mohan Pindyala15-Jun-09 10:12
memberMohan Pindyala15-Jun-09 10:12 
GeneralRe: is this article damaged? Pin
adamspe15-Jun-09 10:42
memberadamspe15-Jun-09 10:42 
GeneralRe: is this article damaged? Pin
Mohan Pindyala15-Jun-09 11:16
memberMohan Pindyala15-Jun-09 11:16 
GeneralRe: is this article damaged? Pin
Mohan Pindyala15-Jun-09 11:18
memberMohan Pindyala15-Jun-09 11:18 
GeneralRe: is this article damaged? Pin
Ivn Y.8-Jul-09 0:03
memberIvn Y.8-Jul-09 0:03 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.170118.1 | Last Updated 22 Jun 2009
Article Copyright 2007 by Mohan Pindyala
Everything else Copyright © CodeProject, 1999-2017
Layout: fixed | fluid