A SAML assertion is a signed security token that an identity provider sends to a service provider during single sign-on. It contains claims about the user, such as identity, roles, group membership, and session details. The service provider trusts the assertion only after checking the signature and other conditions, like issuer, audience, expiration time, and destination.
This matters because the assertion is the bridge between authentication and access. If an attacker can forge, modify, replay, or trick a system into accepting a bad assertion, they may bypass login and inherit another user’s privileges. Defenders protect this path by validating cryptographic signatures correctly, enforcing strict trust settings, rejecting expired or mismatched assertions, and reviewing SSO logs for unusual role mappings or login patterns.