Vulnarex | Elite Cybersecurity Learning Platform

#The XML 'Ticket' of Identity#link

Building on the architecture, we now examine the 'SAML Assertion.' An assertion is a signed XML document that the IdP provides to the SP to prove a user's identity and provide specific attributes about that user.

The Three Types of Assertions

Not all assertions are created equal. Depending on the needs of the Service Provider, the IdP can issue different types of claims within the XML structure.

Assertion Type	Purpose	Example Claim
Authentication Assertion	Confirms the user logged in	AuthnInstant: 2023-10-01T10:00Z
Attribute Assertion	Provides user data (Roles, Email)	Role: 'Global-Admin'
Authorization Decision	Confirms if user has a specific right	Decision: 'Permit'

The most common combination is an Authentication assertion paired with an Attribute statement, which tells the SP who the user is and what group they belong to in the corporate directory.

Anatomy of a SAML Assertion

info

💡 The most critical elements are the `<Subject>` (who the user is) and the `<Conditions>` (when the token expires).

xml

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
  <saml:Issuer>https://idp.example.com</saml:Issuer>
  <saml:Subject>
    <saml:NameID>john.doe@example.com</saml:NameID>
  </saml:Subject>
  <saml:Conditions NotBefore="2023-10-01T09:00Z" NotOnOrAfter="2023-10-01T10:00Z" />
  <saml:AttributeStatement>
    <saml:Attribute Name="groups">
      <saml:AttributeValue>IT_Security_Team</saml:AttributeValue>
    </saml:Attribute>
  </saml:AttributeStatement>
  <ds:Signature>...</ds:Signature>
</saml:Assertion>

The XML above is a simplified assertion. The `<ds:Signature>` block ensures that the SP can verify that the IdP—and only the IdP—created this document.

Security Risks in Assertions

STRICT SECURE AUDIT RULE

If an SP does not validate the `NotOnOrAfter` condition, a captured assertion could be re-used indefinitely (Replay Attack).

▪Verify the Issuer matches the expected IdP
▪Check the NotOnOrAfter timestamp
▪Validate that the Subject (NameID) is not empty
▪Verify the Digital Signature before processing any attributes

STRICT SECURE AUDIT RULE

Avoid putting extremely sensitive data (like PII) in assertions unless the assertion is encrypted using the SP's public key.

quiz BLOCK (★ 50 XP)

Which part of the SAML assertion is used to prevent a captured token from being used hours or days later?

Select your proof vectors above

challenge BLOCK (★ 100 XP)

The Identity Swap