The OAuth2 SAML bearer spec describes how an application can present an assertion to a token endpoint as an authorization grant. For example, Salesforce's API allows this approach to enable apps to autonomously request access tokens for a user account (as long as the user has already given permission for this, out-of-band).

I'm having trouble making sense of what the assertion means, though. Most of it is clear enough, e.g.

  • Issuer is the party that generated (and signed) the assertion
  • Subject is the user for whose account an access token is being requested
  • AudienceRestriction limits the audience to the token endpoint.

But I'm having trouble understanding the meaning of:

  • AuthnStatement -- My understanding from the SAML spec is that the issuer of this assertion is making the statement that it (the issuer) has authenticated the subject. Is this right?

  • SubjectConfirmation -- who is confirming what here? The SAML spec helpfully states that this element "Information that allows the subject to be confirmed". But what is confirmation? And who performs it, and how, and when, and for what purpose?

authentication oauth-2.0 saml assertions
Edit
Report