# SAML 2.0

Source: https://xmlvalid.com/schemas/saml-2.0-protocol

> SAML 2.0 single sign-on messages: authentication requests, responses with assertions, logout.

Identity providers (Okta, Entra ID, Keycloak, ADFS) and service providers exchange these messages during single sign-on. A decoded SAMLResponse can be pasted here to check its structure.
The protocol schema imports the assertion, XML Signature and XML Encryption schemas, included here.

- Type: XSD
- Version: 2.0
- Namespace: `urn:oasis:names:tc:SAML:2.0:protocol`
- Root element: `Response, AuthnRequest, LogoutRequest, …`
- Publisher: OASIS Security Services TC (OASIS copyright notice), source: https://docs.oasis-open.org/security/saml/v2.0/
- Validate against it: https://xmlvalid.com/validate?schema=saml-2.0-protocol

## Notes

- Only the structure is checked. Signatures, certificates, audience, timestamps and replay are verified by the service provider, not by the schema.
- Decode the Base64 SAMLResponse first; paste the XML, not the encoded form.
- The example is by xmlvalid.com: an unsigned response with illustrative values.