SAML Explained
Practice this topic in a realistic system design interview
Suppose you work at a company that uses twenty different applications. Email, a chat tool, a code repository, a CRM, an HR portal, and many more.
If every application has its own username and password, employees have to manage twenty sets of credentials. Many of them will reuse the same password, or write it down somewhere.
The IT team has a problem too. When a new employee joins, someone has to create twenty accounts. And when an employee leaves, someone has to remember to disable all twenty. If even one account is missed, a former employee may still have access to company data.
A better approach is to have one central place where employees log in. Every application trusts that central system to confirm who the user is. This is called single sign-on, or SSO. And SAML is one of the most widely used standards for building it, especially in enterprise software.
In this chapter, we will look at what SAML is, how a SAML login works step by step, what is inside a SAML assertion, and what a service provider must validate to keep SAML login secure.