SAML陈述的消费者必须在信任SAML陈述之前确信底层的基础设施。
基于SAML的系统的安全风险是什么？
使用SAML不记名主体确认令牌来传播用户身份。
The SAML source site erases its artifact-to-assertion mapping after the first use of the artifact, making replayed artifacts invalid.
取自SAML断言的信息优先于通过控制对象属*传递的信息。
既然SAML与XACML分享同一个领域，那么这两种规范很可能最终会合并成一个规范，希望如此。
xml密钥管理规范(XML Key Management Specification,XKMS)使得安全*基础设施易于管理，而安全*断言标记语言(SecurityAssertionMarkup Language,SAML)则使信任可以移植。
What are the security risks in an SAML-based system?
SAML? for real or were they just hype and trickery meant to spur the acquisition?
SAML提供了避免重播攻击的保护。SAML要求在传输断言和消息时使用ssl加密，以专门防止断言被拦截。
但为简便起见，我们将STS配置为不签署SAML断言。
另外，还缺少对SAML的个人化属*、会话上下文或即时用户帐号准备的整合支持。
让SAML处理匿名或访客访问是可能的，但是这要求参与的企业就其自己的匿名访问或访客授权访问的约定达成一致。
Misunderstanding: SAML defines a discovery procedure to find authentication authorities
Exchange the SAML Assertion to a different security protocol able to carry the service identity.
In my next article, I will focus on explaining how to make this trust portable using SAML.
Given that both SAML and XACML share the same domain, it is highly likely and desirable that these two specifications will eventually be merged into one.
设想你买了台电脑，附带一个*头，可是你只能用在百分之五到十的*座上——而这就是SAML现在的采用率，SPML和XACML则落后的更多。
Consumers of the SAML statements must be sure of the underlying infrastructure before trusting the SAML statements.
一致*规范有助于客观地评价SAML实现或应用程序对SAML规范的一致程度。
我们将创建接收入站负载的“请求规则”，检查ltpa验*，然后注入SAML断言，以便在下游使用。
Myth: SAML is an authentication authority.
For example, the namespace "urn:oasis:names:tc:SAML:1.0:action:ghpp" defines the get/head/put/post http actions that SAML operations use.
It is possible to get SAML to handle anonymous or guest access, but this requires that the participating enterprises agree to their own convention for anonymous or guest authorized access.
Conformance specifications help to objectively evaluate an SAML implementation or application for its conformance to the SAML specification.
The information derived from the SAML assertions is to take precedence over that passed as immediate attributes of the control object.
Using a SAML bearer subject confirmation token to propagate a user's identity.
例如，当LDAP服务器对一个用户进行认*时，认*权威机构是LDAP服务器—即使LDAP服务器可能正在使用SAML来传送认*。
SAML通常被认为是一项Web服务标准，不过事实上，它却提供了*于平台和协议的联合标识的总体管理结构。
Myth: SAML is easy to break using replay techniques.
We'll be creating a Request Rule that receives an inbound payload, checks for LTPA validity, then injects a SAML assertion for downstream use.
SAML常常被吹捧提供了一种单点登录(SSO)机制。
国文精选馆
