ePrivacy and GPDR Cookie Consent by Cookie Consent

What is a SAML Assertion?

If you are just starting out trying to understand SAML you will come across the term SAML Assertion quite quickly. In this post or tutorial, I will try to explain to you what a SAML Assertion is and give you some examples on how they could look. This post mainly looks at the SAML Assertion in the perspective of the SAML Web Browser Profile. If you don't know what that is, have a look on my post about exactly that

What is a SAML Assertion?

The SAML Assertion is the main piece in the SAML puzzle. This is the object that the rest of SAML is build to safely build, transport and use.

A SAML Assertion is basically a package with security information about a entity.(e.g. A user) issued from the Identity Provider(IdP) to the Service Provider(SP). When the user has authenticated with the IdP a SAML Assertion is sent to the SP with the IdPs information about that user.

What does a SAML Assertion contain?

The SAML Assertion contains some general information like, who sent it, what time it was sent and validity period of the assertion. The assertion also contains statements about a user. These come in three different types.

Authentication

The authentication statement contains, not surprisingly, information about the authentication of the user. Mainly when and by what means the user was authenticated.

1<saml:authnstatement 
2      authninstant="2010-11-04T14:04:30Z" 
3      sessionindex="s22428b07e56ce0dbd3f72237ce29c585541db5d01">
4   <saml:authncontext>
5      <saml:authncontextclassref>
6         urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
7      </saml:authncontextclassref>
8   </saml:authncontext>
9</saml:authnstatement>

Attribute

The attribute statement can contain application specific attributes connected to the user, for example. Address, telephone number social security number.

 1<saml:attributestatement>
 2   <saml:attribute name="social">
 3      <saml:attributevalue 
 4            xmlns:xs="http://www.w3.org/2001/XMLSchema"
 5            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 6            xsi:type="xs:string">
 7         555501234
 8      </saml:attributevalue>
 9   </saml:attribute>
10   <saml:attribute name="email">
11      <saml:attributevalue 
12            xmlns:xs="http://www.w3.org/2001/XMLSchema" 
13            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
14            xsi:type="xs:string">
15         someone@example.com
16      </saml:attributevalue>
17   </saml:attribute>
18   <saml:attribute name="telephone">
19      <saml:attributevalue 
20            xmlns:xs="http://www.w3.org/2001/XMLSchema" 
21            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
22            xsi:type="xs:string">
23         546848134886
24      </saml:attributevalue>
25   </saml:attribute>
26</saml:attributestatement>

Authorization

The authorization statement contains information about the users access rights to different resources. This statement can be used for basic authorization. For more advanced authorization cases I recommend taking a look at the XACML standard

1<saml:authorizationdecisionstatement 
2      decision="Permit" 
3      resource="http://www.example.org/customers/getCustomers">
4   <saml:action>Read</saml:action> 
5</saml:authorizationdecisionstatement>

What does a SAML Assertion look like?

Here is an example on what a whole can look like.

 1<saml:assertion 
 2      id="s2365479533bf942f8eaaa2c267f9bd4ff679ebc1f" 
 3      issueinstant="2011-01-24T08:47:50Z" 
 4      version="2.0" 
 5      xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
 6   <saml:issuer>IDP-alias</saml:issuer>
 7   <saml:subject>
 8      <saml:nameid 
 9            format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" 
10            namequalifier="IDP-alias" 
11            spnamequalifier="my-alias">
12         5VkzP/MZ1PMJ62o45/7DdFms9y7K
13      </saml:nameid>
14      <saml:subjectconfirmation method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
15         <saml:subjectconfirmationdata 
16               inresponseto="_bba7e8a2f7a7c51e339d614b2c2d1178" 
17               notonorafter="2011-01-24T08:57:50Z" 
18               recipient="https://myIDP.test.com/saml/consumer">
19         </saml:subjectconfirmationdata>
20      </saml:subjectconfirmation>
21   </saml:subject>
22   <saml:conditions notbefore="2011-01-24T08:37:50Z" notonorafter="2011-01-24T08:57:50Z">
23      <saml:audiencerestriction>
24         <saml:audience>my-alias</saml:audience>
25      </saml:audiencerestriction>
26   </saml:conditions>
27   <saml:authnstatement 
28         authninstant="2011-01-24T08:47:50Z" 
29         sessionindex="s212cd7811734a92405b6ef8308a1b1a98e32e6f01">
30      <saml:authncontext>
31         <saml:authncontextclassref>
32            urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
33         </saml:authncontextclassref>
34      </saml:authncontext>
35   </saml:authnstatement>
36   <saml:attributestatement>
37      <saml:attribute name="social">
38         <saml:attributevalue 
39               xmlns:xs="http://www.w3.org/2001/XMLSchema" 
40               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
41               xsi:type="xs:string">
42            555501234
43          </saml:attributevalue>
44      </saml:attribute>
45      <saml:attribute name="email">
46         <saml:attributevalue 
47               xmlns:xs="http://www.w3.org/2001/XMLSchema" 
48               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
49               xsi:type="xs:string">
50            someone@example.com
51         </saml:attributevalue>
52      </saml:attribute>
53      <saml:attribute name="telephone">
54         <saml:attributevalue 
55               xmlns:xs="http://www.w3.org/2001/XMLSchema" 
56               xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
57               xsi:type="xs:string">
58            546848134886
59         </saml:attributevalue>
60      </saml:attribute>
61   </saml:attributestatement>
62</saml:assertion>