SAML & SSO Explained: How Enterprise Single Sign-On Actually Works
At a new job you log in once — and Slack, Jira, GitHub, Salesforce, and every internal tool just work, with no extra passwords. That's Single Sign-On (SSO), and in most enterprises it's powered by SAML. This is Part 2 of a 3-part Auth Fundamentals series. We cover what SSO really is (Identity Providers and Service Providers), what a SAML assertion is, the SP-initiated SAML flow step by step, SAML vs OIDC and when to use each, and the security catch with IdP-initiated SSO.
Auth Fundamentals series:
Part 1 — OAuth 2.0 & OIDC
Part 2 — SSO & SAML (this video)
Part 3 — LDAP
Chapters:
0:00 Intro
0:03 Log in once, everything works
0:47 Recap: OAuth & OIDC (Part 1)
1:25 What SSO really is (IdP & SP)
2:28 What is SAML (the assertion)
3:22 The SAML flow: request & login
4:06 The SAML flow: assertion & session
4:56 SAML vs OIDC: when to use each
6:11 IdP-initiated SSO
6:54 Recap + Part 3 (LDAP)