Get the latest tech news
SAML: A Technical Primer
A technical overview of SAML works, and how it fits into your product and your customer's business
SAML supports the idea of putting “metadata” on a login session, configuring “conditional access”, and lots of other fancy functionality. If the identity provider decides to not proceed — maybe the user is fired, or maybe hasn’t been internally authorized to use your application (e.g. your customer only wants engineers using your app, but the employee works in sales), then from your perspective, nothing happens. This algorithm is hairy in the details, but at a high level it is there to make operations like “remove the<Signature> element from the<Assertion> ” be something that two parties can carry out, and still end up with exactly the same set of bytes.
Or read this on Hacker News
