Service Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party.
The service provider does the validation, and therefore owns most of the risk in a federation. Checking the signature is necessary and not sufficient: the assertion must be for this SP, recent, unreplayed, and from the expected issuer with an algorithm you chose rather than one the message declared. A long run of SAML bypasses come from skipping one of those.
See also: identity provider, relying party, SAML 2.0, federation
Related on Start with Identity
- GlossarySSO
Single Sign-On. A user authenticates once and gains access to multiple applications without re-entering credentials. Implemented with SAML or OIDC in modern dep
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEruby-saml denial of service via compressed SAML messages
A compressed SAML message can be inflated into a resource-exhaustion hit against ruby-saml. Not an impersonation bug, but it sits in the same March 2025 patch t
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossarySAML 2.0
Security Assertion Markup Language. An XML-based protocol for federated authentication, dominant in enterprise SSO. Largely superseded by OIDC for new deploymen