Security and Access Control Implementations using SAML in Modern Web Services

Establishing trust for web services in an online context consists of securing user identities and providing access control.The Security Assertion Markup Language (SAML) is the most widely used protocol for identity federation and establishes a secure Single Sign-On (SSO) for any number of domains.This article is a comprehensive review of the design architecture, security characteristics, implementation considerations and performance benchmarks, as well as a comparison to other identity protocols such as OAuth and OpenID Connect.We provide theoretical models and diagrams to illustrate federated security mechanisms and assess the outcomes of pilot projects from around the world.Finally, we recommend possible future research and development avenues for access control developments using SAML with respect to scalability, cloud native environments and Internet of Things (IoT) considerations.