Security Assertion Markup Language (SAML) is best described as which?

• A. An open-source option for SSO capabilities that utilized SAML.
• B. An attestation model built upon XML for SOAP-based web services.
• C. An open standard decentralized protocol for authentication users.
• D. Allows different websites to rely on a trusted third party to authenticate users.

Answer: (B)

SAML is an XML-based framework for exchanging authentication and authorization data between parties, typically an identity provider and a service provider. The essential idea is that the identity provider issues a digitally signed assertion that confirms a user’s identity (and possibly attributes), and the service provider uses that assertion to grant access without requiring the user to log in again. This is why the description that it is an attestation model built on XML for SOAP-based web services fits best: it emphasizes the XML-based assertions that attest to authentication and how they are transported in a way that has been used in web services. The other descriptions are less precise about how SAML works: it’s a standard, not necessarily an open-source option itself; it’s not inherently a decentralized protocol; and while it enables users to rely on an identity provider, that simplification doesn’t capture the assertion mechanism at the heart of SAML.