SAML 2.0 について

Words near each other

・ Samme stof som stof
・ Sammee Tong
・ Sammelanam
・ Sammelband
・ Sammer
・ Sammeron
・ Sammes
・ Sammezzano
・ Sammi (dance)
・ Sammi Adjei
・ Sammi Cheng
・ Samkon Gado
・ Samkori
・ Samkos bush frog
・ SAML 1.1
・ SAML 2.0
・ SAML-based products and services
・ Samla Mammas Manna
・ Samlade Tider
・ Samlah of Masrekah
・ Samlakki tree frog
・ Samland
・ Samland District
・ Samland Offensive
・ Samlar machu
・ Samlaut Multiple Use Area
・ Samlaut Uprising
・ Samleng Yuvachun
・ Samleren
・ Samlerhuset

Dictionary Lists

mini英和辞書

翻訳と辞書　辞書検索 [ 開発暫定版 ]

スポンサードリンク

SAML 2.0 ：ウィキペディア英語版

SAML 2.0

Security Assertion Markup Language 2.0 (SAML 2.0) is a version of the SAML standard for exchanging authentication and authorization data between security domains. SAML 2.0 is an XML-based protocol that uses security tokens containing assertions to pass information about a principal (usually an end user) between a SAML authority, that is, an identity provider, and a SAML consumer, that is, a service provider. SAML 2.0 enables web-based authentication and authorization scenarios including cross-domain single sign-on (SSO), which helps reduce the administrative overhead of distributing multiple authentication tokens to the user.〔https://www.youtube.com/watch?feature=player_embedded&v=50ogFCF56qE〕
SAML 2.0 was ratified as an OASIS Standard in March 2005, replacing SAML 1.1. The critical aspects of SAML 2.0 are covered in detail in the official documents SAMLConform,〔 SAMLCore,〔 SAMLBind,〔 and SAMLProf.〔
Some 30 individuals from more than two dozen companies and organizations were involved in the creation of SAML 2.0. In particular, and of special note, Liberty Alliance donated its Identity Federation Framework (ID-FF) specification to OASIS, which became the basis of the SAML 2.0 specification. Thus SAML 2.0 represents the convergence of SAML 1.1, (Liberty ID-FF 1.2 ), and (Shibboleth 1.3 ).
==SAML 2.0 Assertions==

An assertion is a package of information that supplies zero or more statements made by a SAML authority. SAML assertions are usually made about a subject, represented by the element. The SAML 2.0 specification defines three different kinds of assertion statements that can be created by a SAML authority. All SAML-defined statements are associated with a subject. The three kinds of statements defined are as follows:
* Authentication Assertion: The assertion subject was authenticated by a particular means at a particular time.
* Attribute Assertion: The assertion subject is associated with the supplied attributes.
* Authorization Decision Assertion: A request to allow the assertion subject to access the specified resource has been granted or denied.
An important type of SAML assertion is the so-called "bearer" assertion used to facilitate Web Browser SSO. Here is an example of a short-lived bearer assertion issued by an identity provider (https://idp.example.org/SAML2) to a service provider (https://sp.example.com/SAML2). The assertion includes both an Authentication Assertion and an Attribute Assertion , which presumably the service provider uses to make an access control decision. The prefix saml: represents the SAML V2.0 assertion namespace.

xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
ID="b07b804c-7c29-ea16-7300-4f3d6f7928ac"
Version="2.0"
IssueInstant="2004-12-05T09:22:05">
https://idp.example.org/SAML2
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">...

Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">
3f7b3dcf-1674-4ecd-92c8-1544f346baf8

Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
InResponseTo="aaf23196-1773-2113-474a-fe114412ab72"
Recipient="https://sp.example.com/SAML2/SSO/POST"
NotOnOrAfter="2004-12-05T09:27:05"/>

NotBefore="2004-12-05T09:17:05"
NotOnOrAfter="2004-12-05T09:27:05">

https://sp.example.com/SAML2

AuthnInstant="2004-12-05T09:22:00"
SessionIndex="b07b804c-7c29-ea16-7300-4f3d6f7928ac">

urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

xmlns:x500="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"
x500:Encoding="LDAP"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
FriendlyName="eduPersonAffiliation">
xsi:type="xs:string">member
xsi:type="xs:string">staff

Note that in the above example the element contains the following child elements:
* a element, which contains the unique identifier of the identity provider
* a element, which contains an integrity-preserving digital signature (not shown) over the element
* a element, which identifies the authenticated principal (but in this case the identity of the principal is hidden behind an opaque transient identifier, for reasons of privacy)
* a element, which gives the conditions under which the assertion is to be considered ''valid''
* a element, which describes the act of authentication at the identity provider
* a element, which asserts a multi-valued attribute associated with the authenticated principal
In words, the assertion encodes the following information:

The assertion ("b07b804c-7c29-ea16-7300-4f3d6f7928ac") was issued at time "2004-12-05T09:22:05Z" by identity provider (https://idp.example.org/SAML2) regarding subject (3f7b3dcf-1674-4ecd-92c8-1544f346baf8) exclusively for service provider (https://sp.example.com/SAML2).

The authentication statement, in particular, asserts the following:

The principal identified in the element was authenticated at time "2004-12-05T09:22:00" by means of a password sent over a protected channel.

Likewise the attribute statement asserts that:

The principal identified in the element is a staff member at this institution.

抄文引用元・出典: フリー百科事典『ウィキペディア（Wikipedia）』
■ウィキペディアで「SAML 2.0」の詳細全文を読む

スポンサードリンク

翻訳と辞書 : 翻訳のためのインターネットリソース