What is SAML (Security Assertion Markup Language)?
SAML (Security Assertion Markup Language) 2.0 is an OASIS standard for single sign-on. An identity provider authenticates the user and sends the application a digitally signed XML assertion stating who the user is and, optionally, attributes such as email and department. The application trusts the assertion instead of keeping its own password for that user.
How Personal Academy handles it
Personal Academy offers SAML single sign-on through its authentication service on every paid plan, from the lowest paid tier.
A worked example
Suppose a 300-person bank requires every employee tool to sign in through its corporate identity provider. The IT team exchanges metadata with the learning platform: the platform entity identifier and assertion address go to the identity provider, and the identity provider signing certificate goes to the platform. Employees then open the learning platform, are sent to the familiar corporate sign-in page, and return signed in.
SAML 2.0 was ratified in 2005 and remains the most common single sign-on protocol in large organisations. It defines three roles: the user, the identity provider (IdP) that knows who the user is, and the service provider (SP), the application the user wants to reach.
In the usual flow, called SP-initiated sign-on, the user opens the application, which redirects the browser to the identity provider with an authentication request. The IdP checks the user, often with a password and a second factor, and posts a signed SAML response back to the application assertion consumer service. The application checks the signature against the IdP certificate, checks the audience, time window and recipient, and starts a session. In IdP-initiated sign-on the user starts from a portal of apps instead.
Setup is done by exchanging metadata: XML documents that list entity identifiers, endpoint addresses and signing certificates. Certificates expire, so rotation needs planning to avoid a sudden outage.
SAML handles authentication, not account lifecycle. If a person is removed from the identity provider, they can no longer sign in through SAML, but their account in the application may remain until it is deactivated. That is why SAML is often paired with SCIM provisioning. Some products also create accounts on first sign-in (just-in-time provisioning) or map IdP groups to application roles; these are separate features to check for.
Many software vendors restrict SAML to their most expensive plan, a practice known as the SSO tax. When comparing products, check which plan includes it and whether provisioning comes with it.