Back to 20 Concepts
oauth-oidc • Expert
Enterprise Single Sign-On (SSO): SAML 2.0 vs OIDC & XML Signatures
SAML 2.0 exchanges XML-based assertions between an Identity Provider (Okta, Azure AD) and a Service Provider (enterprise SaaS application). Authentication occurs via browser POST/Redirect bindings with XML digital signatures.
Intuitive Mental Model
The Corporate Security Escort: You arrive at an enterprise skyscraper (SaaS app). The guard directs you to the corporate identity office (Okta). The corporate office hands you an official signed wax-sealed letter (SAML XML Assertion) that the building guard accepts.
Architecture Blueprint & CodeProduction Standard
<!-- SAML 2.0 XML Assertion: -->
<saml:Assertion ID="_abc123" IssueInstant="2026-08-14T10:00:00Z">
<saml:Issuer>https://idp.okta.com/exk123</saml:Issuer>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">alice@corp.com</saml:NameID>
</saml:Subject>
<ds:Signature>...</ds:Signature>
</saml:Assertion>Key Architectural Takeaways
- •Enterprise Standard: Ubiquitous in Fortune 500 IT departments for central employee onboarding and offboarding.
- •XML Signature Wrapping (XSW): High-severity security vulnerability where attackers inject forged assertions outside the signature validation scope.
Common Architectural Pitfall
Validating SAML XML assertions using standard DOM parsers without strict schema validation, enabling XML Signature Wrapping attacks.
Production Best Practice
Use enterprise-grade SAML libraries (Passport-SAML, node-saml) that strictly enforce signature target URI references.