IT Glossary

SAML

SAML is an XML standard for exchanging authentication data and enabling SSO. Learn how SAML works, how it differs from SCIM, and where Corma fits in.

June 8, 2026

SAML (Security Assertion Markup Language) is an open, XML-based standard that lets an identity provider securely pass authentication and authorization data to a service provider. It is the protocol most commonly used to enable browser-based Single Sign-On for enterprise applications, allowing a user authenticated by the IdP to access a connected app without a separate login.

How SAML works

  • A user tries to open a service provider application.
  • The application generates a SAML authentication request and redirects the user to the IdP.
  • The IdP authenticates the user and creates a signed SAML assertion containing identity and attribute data.
  • The assertion is sent back to the application, which validates the signature.
  • Trust is established, and the user is logged in.

SAML vs SCIM

SAML and SCIM solve different problems and are often confused. SAML handles authentication at login time, while SCIM handles account provisioning before and after login.

SAML vs SCIM: Key Differences

Dimension SAML SCIM
Purpose Authentication and SSO User account provisioning and sync
When it runs At each login When accounts are created, updated, or removed
Data format XML JSON over REST
Core question Can this user log in now? Should this user have an account at all?

Examples and use cases

A company rolls out SAML so employees reach Salesforce and Workday through one IdP login. But SAML alone does not create or delete the Salesforce account. If an employee leaves and only SAML is configured, the account can linger. Pairing SAML (login) with SCIM (lifecycle) closes that gap.

Related concepts

FAQ

Is SAML still relevant in 2026?

‍Yes. SAML remains the dominant SSO standard for enterprise web apps, even as OIDC grows for mobile and modern APIs.

What is the difference between SAML and OAuth?

‍SAML is built for authentication and SSO, while OAuth is built for authorization (granting access to resources). OIDC adds an authentication layer on top of OAuth.

Does SAML provision user accounts?

‍No. SAML authenticates existing users. Creating and removing accounts is the job of SCIM or another provisioning method.

Corma layers governance on top of SAML SSO so login and lifecycle stay aligned. See automated provisioning or request a demo.