How does SAML Authentication Work?

Recently, I joined KubeNine as a DevOps engineer. As part of the onboarding process, I received a work email and access to a company dashboard that provides links to all the tools I need.

This dashboard is crucial because it connects me to the various services we use, such as Grafana for monitoring, AWS for cloud services, and Perfect Scale for managing our infrastructure.

On my first day, I logged into the dashboard using my Microsoft account. What caught my attention was that once I was in, I could access all these services—Grafana, AWS, Perfect Scale—without having to enter my login details again. It felt incredibly convenient not to have to remember multiple usernames and passwords.

So, what’s the technology behind this convenience?

It’s called SAML, or Security Assertion Markup Language. SAML allows different services to trust a single source for authentication, so you only have to log in once. This makes it easier for users like me to get to work without unnecessary interruptions.

How SAML Works

Certainly! Here’s the SSO login flow using SAML with Microsoft and Grafana, broken down into a step-by-step format:

1. User Accesses Grafana:
   • The office worker at KubeNine opens Grafana from the company dashboard.
   • In SAML terms, Grafana is the Service Provider.
2. Grafana Sends SAML Authentication Request:
   • Grafana detects that the user is from KubeNine and sends a SAML Authentication Request to the browser.
3. Browser Redirects to Identity Provider (Microsoft):
   • The browser redirects the user to the Identity Provider, which is Microsoft, as specified in the SAML Authentication Request.
4. User Logs in with Microsoft:
   • Microsoft, acting as the Identity Provider, presents a login page.
   • The user enters their Microsoft account credentials.
5. Microsoft Generates SAML Assertion:
   • Once the user is authenticated, Microsoft generates a SAML response (also known as a SAML assertion).
   • This assertion is a cryptographically signed XML document containing information about the user and what they can access on Grafana.
6. Browser Forwards SAML Assertion to Grafana:
   • The browser forwards the signed SAML assertion to Grafana.
7. Grafana Validates the SAML Assertion:
   • Grafana, the Service Provider, validates the SAML assertion to ensure it was signed by Microsoft.
   • This validation is usually done using public key cryptography.
8. Access Granted:
   • Once the assertion is verified, Grafana grants the user access to its dashboard.

The user can now use Grafana based on the permissions specified in the SAML assertion.

Benefits of SAML

SAML offers several key benefits that make it a valuable tool for both users and organizations:

1. Single Sign-On (SSO) Convenience:
   • SAML allows users to log in once and access multiple applications without needing to re-enter credentials. This reduces the hassle of managing multiple usernames and passwords, making the user experience much more convenient.
2. Security:
   • By centralizing authentication through a trusted Identity Provider, SAML reduces the risk associated with password management. Users only need to enter their credentials once, lowering the chances of password fatigue and the risk of phishing attacks.
3. Ease of User Management:
   • For organizations, SAML simplifies user management by centralizing authentication. Administrators can easily control access to various services through a single Identity Provider, making it easier to onboard and offboard employees.
4. Improved Compliance:
   • SAML helps organizations meet regulatory requirements by providing a secure and standardized method for authentication. This ensures that sensitive data is protected and access is granted only to authorized users.
5. Interoperability Across Platforms:
   • SAML is widely supported across various platforms and services, making it a versatile solution for integrating different systems within an organization. SAML enables seamless integration, whether it’s cloud-based applications, on-premises systems, or third-party services.
6. Cost Savings:
   • By reducing the need for multiple authentication mechanisms and simplifying user management, SAML can lead to cost savings in IT support and maintenance. Organizations can focus resources on more critical tasks rather than managing disparate authentication systems.

Other SSO Protocols vs. SAML

SAML isn’t the only Single Sign-On (SSO) protocol out there. There are other options like OpenID Connect and OAuth, each with its own strengths.

• SAML vs. OpenID Connect: While SAML is more established and widely used in enterprise environments, OpenID Connect is often preferred for newer web and mobile applications because it’s simpler to implement.
• SAML vs. OAuth: OAuth is designed more for authorizing limited access to resources (like allowing an app to access your photos) rather than authenticating a user. SAML, on the other hand, focuses on verifying the user's identity across multiple services.

Each protocol has its place, and the choice depends on the specific needs of the application or service being used.

Conclusion

In summary, SAML is a powerful tool that simplifies access to multiple services by allowing you to log in once and use that single login across different platforms. It’s not just about making things easier—it’s about creating a secure and efficient environment for both users and organizations. Whether you’re setting up a new application or managing existing services, understanding how SAML works and how it compares to other SSO protocols can help you make informed decisions that benefit everyone involved.

By using SAML, organizations can provide a better experience for their users while also maintaining a high level of security. So, if you’re looking to streamline access to your services, SAML is definitely worth considering.