Security Assertion Markup Language (SAML)

SSO between different internet domains requires the exchange of authentication information. SAML achieves this through:

• Identity Providers (IdP): Entities that provide authentication information.
• Service Providers (SP): Entities that utilize authentication information to deliver services.

When a user accesses an SP to use a service, the SP redirects their request, along with a SAML authentication request, to the IdP. The IdP processes the authentication request, interacts with the user, and performs the authentication. Once the user is successfully authenticated, the IdP issues an Assertion containing authentication details, user attributes, and access permissions to the SP. Based on this assertion, the SP enforces access control without directly handling user authentication data, enabling seamless SSO for multiple services.

F5’s BIG-IP Access Policy Manager (APM) supports Single Sign-On (SSO) and is fully compatible with SAML (SAML 2.0). It can function as an IdP that performs user authentication and issues assertions or as an SP that receives assertions to control access to applications.