SAML
Security Assertion Markup Language (SAML) is an XML-based standard for exchanging assertions about authentication, attributes, and authorization decisions between systems.
The assertion and the application
In a SAML web single sign-on deployment, an identity provider supplies an assertion to a service provider, the application relying on it. The assertion can describe an authentication event and carry attributes the application uses. SAML also defines authorization-decision statements, though web sign-in does not mean every application action has been approved.
A SAML assertion uses XML. It is a different format from an OpenID Connect ID token, which uses JWT. Both require the receiving application to apply the correct trust and validation rules.
The application session has its own lifetime
In a typical browser sign-in, the browser carries a SAML response from the identity provider to the application. Once the application validates it, the application can establish its own session. Subsequent requests may use that session’s cookie without sending the original SAML assertion again.
This matters during account containment: disabling a user or revoking access at the identity provider may leave an existing application session active. The application needs a way to end that session too. Signing in also leaves application permissions to be enforced; a valid assertion does not authorize every operation.
Validation and session lifetime
Ask the application owner to verify trusted signing keys, issuer, intended audience, recipient, time limits, and request correlation where applicable. Use a maintained SAML implementation; finding a signature in the XML does not mean the application validated the right content correctly.
During incident response, check how the application ends sessions as well as what the identity provider can revoke. Use an authorized test account to check whether the existing session can still perform the relevant operation.