A Developer's Guide to SAML

SAML is one of the most widely used identity security standards in the industry today, yet can seem daunting to support. This is especially true for developers being asked to support SAML for the first time. The age of SAML combined with its numerous revisions over the years makes it difficult to learn and use. Not to mention the complexities of SAML being used in slightly different and nuanced ways in different applications. In this talk, you'll learn all about the SAML protocol, how it works, and how to use it in a modern application. You'll also learn what pitfalls to look out for and how to resolve them.
Speakers:
Nick Gamb, Okta
__
Don't forget to subscribe to our channel and hit the notification bell so you never miss an upload: bit.ly/OktaYout...
__
Additional SAML resources:
auth0.com/blog...
samltool.io/
__
Sign up for our monthly newsletter! a0.to/zeroindex
Want more Okta? Check out our social media for updates:
bit.ly/OktaLink...
bit.ly/OktaTwit...
bit.ly/OktaFace...

[@kepler_iii9373]

Okta's technical guides around identity never disappoint!

[@joneslt]

This was fantastic! There are too many people out there attempting to post technical instructional videos who don't really have an in depth understanding of the material, or don't know how to explain it. This was a rare find. Thanks for posting!

[@mumk]

I totally feel this

[@willhu4272]

It's the best video that explains the whole story of SAML. The extraordinary part is explaining "Most common weak points" start from 17:32!

[@beeramkrishnnareddy8846]

M A

[@pravin24it]

Best thing I found on KZbin for SAML security audit. Thank you very much for detailed information about SAML including the flows.

[@gregorycook5305]

I know this video is old but it's still chock full of information. Thank you for the video sir.

[@jongpac2]

This is the best lecture I have seen including school to online tutorials, I love you!!!

[@andresau90]

THE BEST video for developers to keep things secure!

[@yousifbodagh2113]

The best video on KZbin covering this topic.

[@LexDaBigG]

Best video on SAML ever! Kind had to grin at 7:02 where he talks about the convenience feature of saml metadata! Real shame that okta lacks the upload SP metadata feature ;-) this is quite standard for other IDPs

[@kolcha]

Very well organized guide and superbly presented. You are excellent teacher. Thank you.

[@tech_gadgets_maniac]

Best ever video on SSO... Simply love it

[@JJ89MK12]

Correct me if I'm wrong, but as I understand it SSO only happens when a user performs an Identity Provider Initiation. By providing your credentials to the Identity Provider once, the Identity Provider can send SAML responses toward any application or service you're trying to use. However, if as a user you're required to start the SAML process with the Service Provider first (Service Provider Initiation), then a SAML Request is sent to the Identity Provider who in turn returns a SAML Response. This interaction is only valid for that one, specific Service Provider, not all Service Providers, meaning that you'd have to repeat this login process again for any other application you might want to use. In other words, for any Service Provider that requires you to begin the authentication process with itself first, you're going to be redirected somewhere to provide your login credentials. If you have 3 Service Providers asking to begin the process with each of them, then you're not really participating in a Single-Sign-On experience -- Is this correct?

[@maxwellkgalema5568]

That's a good question and I believe the answer is yes, you not participating.

[@ShijenN]

Great question!!! Did you get the answer for this ?

[@jano.5485]

Yes and no. If the authentication towards the IdP is also done via SSO (for example Kerberos in a Windows Active Directory environment), then it does not matter how many SAML requests are passed to the IdP, it all happens transparently to the user. At least that is my understanding.

[@vil9386]

understood SAML from developers' view at last.... very easily... thank you 🦃

[@321zipzapzoom]

Concepts clearly told and upto Point, Could You do couple of more Videos on QnA involving guys to spend some time along revolving around common Usecases specific to Vendors.

[@dushmanta05]

That was a very good explanation with the security concerns. Thanks.

[@rafaelbraga3d]

Awesome explanation, thanks a lot! Now I understand better this flow!

[@OktaDev]

Glad it helped!

[@victorenoma9131]

Thank you man. Beautiful piece

[@jonathanparker1927]

very nice, thanks for taking the time!

[@aroundthisprettyplanet]

OktaDev videos are the best ever in explaining the concepts! ❤ Would have been much better if you have explained SAML bindings

[@OktaDev]

Noted! Thanks for your feedback and we are glad that you enjoy our videos.

[@AdityaKumar-hy6fo]

Try this one kzbin.info/www/bejne/iafToYuYpdtga80

[@murshidav5123]

Nice once. The concept is clear now. Can you do a video on SAML + NodeJs

[@JohnSmith-wz7he]

Awesome effort . Very good. Thank you for spending the time to make this presentation

[@rashidmehraj8542]

Excellent Video. TBH! i was confused earlier on how to read a SAML response.

[@OktaDev]

Glad we could help! Please also check out these additional resources: auth0.com/blog/how-saml-authentication-works/ samltool.io/

[@728100]

Great explanations regarding SAML like it.

[@YuliyaTsukanava]

Really great explanation! Thank you so much!

[@ahmetcetin3432]

Great, beneficial introduction to SAML, thanks!

[@shubhamsingh-gb5zh]

Amazing explanation 🙇‍♂️

[@revathiramanadham3843]

Best explanation... Thank you.

[@ajmags4731]

This has been very helpful!!!

[@dimitro.cardellini]

Really useful video! Thanks a lot

[@the.rey.ortega]

This is the best video explaining SAML

[@jjrock11]

Nice work, Nick!

[@jdsprankle]

Amazing video, very clearly explained

[@smohanty3507]

thats what I am looking for..perfect explanation

[@rajendrakumarnagraj4690]

Very well explained. Thanks

[@abhishekrai4325]

Thank you so much for this. Amazing explanation !

[@Testacabeza]

Excellent video.

[@AbhishekSen]

Fantastic video!

[@karankanojiya7672]

Excellent Sir !

[@hexchad765]

How would this change when using a CLP (Central Login Page) external to all of this

[@vadivelan4228]

Good one. Thank you.

[@ReviveNRepair]

20:58 This could also be mitigated by making sure all the assertions in the SAML response are signed, right?

[@durangodave]

Great video thank you, well done. However i do have to disagree with you on one thing, using a SSO may be more convenient but it is less secure. The best security IMO is to keep PW under personal care and just find a way to remember them. This is less convenient but the fewer parts involved in security validation the better. It is similar to telling noone your password vrs telling 5 friends with the promise they wont tell anyone. Security is only as good as the weakest link and the more links involved the less secure IMO. I code for SSO but i do not use SSO personally. Each of us must make the choice based on convenience.

[@sunnyd9878]

Just great awesome explanation

[@jayak3768]

Sir can u clarify that all the SP - IP communication is via client browser and not directly between the two parties. Or is there a back channel between the two parties in addition to the client as the intermediary.

[@OktaDev]

Thanks for watching the video. All the communication between SP and IdP shown in this video happens through the front channel (browser/user agent).

[@lizermo2191]

I love u man. Thanks to you, I'll probably get a better job. I'll keep you updated

[@nagap4231]

Simply Superb

[@olmanmora21]

27 minutes on youtube sometimes is way better than 4 hours in a lesson room.

[@ignaciosplenda2913]

Flawless, thanks!

[@suhaibshanaa508]

How can we dockerize this process? and if each SP has different Data what is the good way to save it rather than clone each project and change the metadata and XML file and so on? Can you help?

[@ismway]

Http artifect binding in SAML , can u explain real use case and which kind of attack gets eliminated and how to use it

[@yashgangrade5460]

Totally worth it.

[@jondo-vh8tx]

very well explained

[@MuhammadAwais-m5x]

@OktaDev, In 'Limit the XML Parser" , is the sub heading 'Disable Document Type Definition (DTD) Fetching' wrong and ought to be 'Document Type Definition (DTD) Fetching? ( Felt like that from context )

[@gandarmarc2059]

Very clear

[@oleksandrlytvyn532]

Thanks

[@drenyl6491]

How to generate SAML request xml? Should the developer of the application generate and supply value on the xml tags?

[@g2D1]

Terrific!

[@jagdeepsingh-rx7tw]

@oktadev is there a difference between calculation digest value for saml version 1.0 and 2.0?

[@neadlead2621]

very very very good one

[@NTICTECH]

hello thanks for the explanation it was very helpful i want to know how to configure a saml with a loadbalancer i had problem that the load balancer doesn't sign on the SPs

[@sreyas_sj]

In a project that I'm working in, I want to redirect the user to Azure for validating the user, for that how do I redirect him to Azure and generate SAML SSO authentication req? How do I generate this XML req in code, didn't find any resources regarding this Any help would be great. Thanks

[@travel_and_dine4871]

Hi sir, but how system is passing the username / email id in request to validate at IDP

[@danielromerolevy3075]

Awesome explanation!

[@PriyankRupareliya]

Thank you, this is gold

[@АлександрБорискин-т7к]

Perfect explanation, thanks!

[@mlfman]

This is awesome

[@fsams068]

Very clear, thanks a lot for that!

[@vipinkoul595]

why do we need to have user profile at Service provider? I am under the assumption that all user details are only in IDP, and not in SP. why do we need to have user details in SP? In that case, can't we skip SSO and login directly into SP if SP is also having user details. Doesn't having user details in IDP and SP keep information at two places? Can anyone help explain it, please.

[@TedS-yt2yg]

If you are allowing users to login directly or use IDP, the profile will need to be stored on the SP side. Even if IDP is the only login solution, a minimum of information needs to be stored on the SP side to determine who logged in using the IDP - probably an email address. The email address provided by the IDP needs to match an email address on the SP side. There are alternatives to this as can be seen in the provisioning section.

[@ФаррухИмамбердиев-в7м]

Excellent explanation, thanks. I finnaly understand SAML and difference beetwen this protocol and OAuth/OpenId Connect. I alse recommend watch video about OAuth/OpenId Connect by Nate Barbettini in this chanell

[@OktaDev]

You are welcome! That video from Nate is great!

[@gdocs1307]

Identity Provider means that all users has to be registered there with actual credentials?

[@vishalgarg7102]

No , Actual credentials are saved in Database . Generally IDP communicate with DB for authentication

[@germanmartin8778]

Thanks you so much, for explain SAML

[@Jacobra60]

Good video. Could you show viewing and debugging SAML requests/responses in Chrome or FF. Also can you show some examples of claims rules.

[@viswam020]

HI Pls upload OIDC/OPENID full video and grant flows..,

[@saisrivastavatumuluri9291]

i like the security part of the vedio

[@esra_erimez]

Fantastic!

[@ashannaveen9946]

Good explanation.

[@hassaneloufir8440]

thank you so much, grand respect.

[@davidaustin967]

great guide - thanks for video

[@PaulFidika]

Why is he only talking into my right ear?

[@muhammadusamaalvi6910]

very well explained.

[@gabrielvinante]

now i understand! great explanation. do you have a video using simpleSamlPhp? thanks in advance

[@samyakjain5974]

Can you explain a bit on how to Validate a signature

[@mohamedhashish216]

Thank you so much

[@nouribenz]

Thanks for ur time

[@wegwerfDave]

Really good

[@sudipghosh7253]

Clean and perfect 🔥

[@focalpointcdw9731]

Great video

[@SJPYT]

Thanks mate!

[@swedixx65]

Great video! :)

[@MrWaf007]

attrubtes?

[@khaledyalraymi2468]

Thank you.

[@ghanshyamkhatri3541]

simply Wow!!!

[@rezakhan9973]

Perfect - thanks

[@SaikiranMurthy]

this was good , however i need some more info on Canvas vs SAML

[@JessicaMartinez-kd7vx]

Good stuff

[@stackunderflow5951]

Well, it's better to walk through a SAML workflow and then explain the SAML terms and concepts. It will be more clear.

[@purplepanther4153]

Confusing.

[@dsldsl6460]

This is a good answer to why is still easy to hack a big company :)) . The pour dev has to be extra carefull when configuring the xml parser :)))

[@Spegix1]

Amazing, thank you for all the work you do!

[@LadyLatency]

ATTRUBTES!!