What You Will Learn

• What SAML SSO is.
• The roles of Identity Provider and Service Provider.
• How SAML assertions and metadata work.
• How a Spring application participates in SSO.
• Common production configuration checks.

Introduction

SAML stands for Security Assertion Markup Language.

SAML SSO allows users to authenticate with a central identity provider and access multiple applications without separate logins.

Key Roles

Role	Meaning
Identity Provider	Authenticates the user
Service Provider	Your application
Assertion	Signed statement about the user
Metadata	XML describing endpoints and certificates

SAML Login Flow

sequenceDiagram
    participant User
    participant SP as Service Provider
    participant IdP as Identity Provider
    User->>SP: Access protected page
    SP-->>User: Redirect to IdP
    User->>IdP: Login
    IdP-->>User: SAML response
    User->>SP: Post SAML response
    SP->>SP: Validate signature and claims
    SP-->>User: Authenticated session

Spring Security SAML Dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-saml2-service-provider</artifactId>
</dependency>

Security Configuration

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .anyRequest().authenticated()
        )
        .saml2Login(Customizer.withDefaults());

    return http.build();
}

What to Validate

• SAML response signature.
• Assertion audience.
• Assertion issuer.
• Certificate trust.
• Assertion expiration.
• User attributes and group claims.

SAML vs OIDC

SAML	OIDC
XML based	JSON and JWT based
Common in older enterprise SSO	Common in modern cloud identity
Browser SSO focused	Works well for web, mobile, and APIs

Summary

SAML remains important in enterprise Java applications. A secure SAML setup depends on correct metadata, trusted certificates, signed assertions, and careful claim mapping.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: LDAP Authentication with Spring Boot
• Next: Multi-Factor Authentication Implementation