askmeidentity · SAML Response · 2026-05-22
SAML 2.0 Response — cheat sheet
A printable cheat sheet decoding the structure of a SAML 2.0 Response — every element + attribute + what the SP must validate.
Response envelope
| <samlp:Response> | root element | ID + IssueInstant + Destination + InResponseTo |
| <saml:Issuer> | IdP EntityID | Must match SP's configured IdP |
| <ds:Signature> | optional | Signs the Response (recommended) |
| <samlp:Status> | status code | urn:oasis:names:tc:SAML:2.0:status:Success |
| <saml:Assertion> | one or more | The authentication assertion(s) |
Assertion structure
| <saml:Issuer> | IdP EntityID | Repeated inside Assertion |
| <ds:Signature> | recommended | Signs the Assertion (required for security) |
| <saml:Subject> | who they are | NameID + SubjectConfirmation |
| <saml:Conditions> | when valid | NotBefore + NotOnOrAfter + AudienceRestriction |
| <saml:AuthnStatement> | how they authed | AuthnContextClassRef |
| <saml:AttributeStatement> | who they are | Email, groups, custom attrs |
SP must validate (every time)
- Signature on Assertion (or Response) — chain to a configured IdP cert
- IssueInstant within clock skew (±5 minutes typical)
- Conditions/NotBefore ≤ now ≤ Conditions/NotOnOrAfter
- AudienceRestriction matches SP EntityID
- SubjectConfirmation/SubjectConfirmationData/Recipient matches SP ACS URL
- InResponseTo matches a recently-issued AuthnRequest ID
- NameID format matches the configured format
- Replay: assertion ID has not been seen before (cache for at least NotOnOrAfter)
Common AuthnContextClassRef values
| PasswordProtectedTransport | urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport | Password + TLS |
| MultiFactor | urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract | OTP / push |
| X509 | urn:oasis:names:tc:SAML:2.0:ac:classes:X509 | Certificate-based |
| Smartcard | urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI | PIV / smartcard |
| Unspecified | urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified | IdP did not specify |
Common attack vectors
- XML Signature Wrapping — attacker moves the signed element while keeping the signature valid
- Comment injection in NameID — bypasses string-based identity matching
- Assertion replay — same assertion submitted twice (mitigated by replay cache)
- Audience confusion — assertion intended for one SP submitted to another
- Stripped assertion — Response unsigned + Assertion unsigned