Documentation / Platform glossary / Security Assertion Markup Language
Security Assertion Markup Language is an XML-based standard for exchanging authentication and authorization statements between an identity provider and an application. It is the long-established mechanism behind enterprise single sign-on, and remains the default expectation for browser-based access to business applications.
SAML defines three roles. The identity provider authenticates the user and vouches for them. The service provider is the application relying on that assertion. The principal is the person being authenticated.
The unit of exchange is a signed XML assertion containing statements about the principal: that they authenticated, by what method, when, and what attributes they carry — group membership, department, entitlements. The assertion is cryptographically signed by the identity provider, and the service provider validates that signature. Trust derives from the signature, not from the transport.
Two flows are common. Service-provider-initiated starts when a user visits the application, which redirects them to the identity provider to authenticate. Identity-provider-initiated starts from a portal or application launcher. Federation is configured by exchanging metadata — entity identifiers, endpoints, and signing certificates — which is why SAML integrations are set up once per application rather than negotiated per request.
SAML 2.0 dates from 2005 and has not needed replacing for its purpose. It is browser- and enterprise-oriented; OAuth and OpenID Connect are generally preferred for mobile applications and API authorization.
SAML keeps the corporate directory authoritative. Applications do not store passwords, and when someone leaves the organization, disabling their directory account removes access everywhere federation applies — which is what makes offboarding reliable rather than a checklist.
The operational detail that most often causes incidents is certificate expiry. Signing certificates have finite lifetimes, and an unrotated certificate breaks sign-on for every federated user at once.
QueryTek supports federated enterprise sign-on so authentication remains with the customer's identity provider and resolves to the correct tenant context. Public documentation describes the capability; metadata exchange and configuration steps are handled through onboarding rather than published here.
