An assertion is a trusted statement exchanged in a federated identity system. It usually says that a user authenticated successfully, and it may include details such as the user’s identifier, group membership, or the assurance level of the login. The assertion is signed or otherwise protected by the issuing identity provider so the receiving service can verify that it was created by a trusted source and not altered in transit.
Assertions matter because they move trust across systems. In single sign-on and cloud federation, a service often accepts an assertion instead of asking the user to log in again. That makes assertions efficient, but also high value to attackers: if stolen, forged, or replayed, they can be used to impersonate a user or bypass the original authentication step. Defenders reduce this risk with strong signing keys, strict validation, short lifetimes, audience checks, and controls that bind the assertion to the intended recipient.