The OAuth 2.0 Assertion Profile is an abstract extension to OAuth 2.0 that provides a general framework for the use of Assertions as client credentials and/or authorization grants with OAuth 2.0.
This specification profiles the OAuth 2.0 Assertion Profile...
1. To define an extension grant type that uses a SAML 2.0 Bearer Assertion to request an OAuth 2.0 access token when a client wishes to utilize an existing trust relationship, expressed through the semantics of (and digital signature calculated over) the SAML Assertion, without a direct user approval step at the authorization server.
2. To define how a SAML Assertion can be used as a client authentication mechanism. The use of an Assertion for client authentication is orthogonal to and separable from using an Assertion as an authorization grant. They can be used either in combination or separately.
This specification further defies the format and processing rules for the SAML Assertion are intentionally similar, though not identical, to those in the Web Browser SSO Profile defined in SAML Profiles.
Now let's have a look at an end to end scenario which explains how to use SAML 2.0 Bearer Assertion as an grant type.
1. User been redirected to the SAML2 IdP and user authenticates to the SAML2 IdP.
2. SAML2 IdP issues a SAML2 Token with following characteristics and Client Web App verifies the SAML2 token and authenticates the user.
- The Assertion's
Issuer element will contain a unique identifier for the entity that issued the Assertion - which is the SAML2 IdP in our case. - The Assertion will contain
Conditions element with an AudienceRestrictionelement with an element containing a URI reference that identifies the Authorization Server. - The Assertion will contain Conditions
element with an AudienceAudienceRestriction element with an element containing a URI reference that identifies the Client Web App, which is the SAML2 Service Provider and Client Web App must verify element. - The Assertion MUST contain a
element. The subject MAY identify the resource owner for whom the access token is being requested. When using an Assertion as an authorization grant, the Subject SHOULD identify an authorized accessor for whom the access token is being requested (typically the resource owner, or an authorized delegate). - The Assertion MUST have an expiry that limits the time window during which it can be used. The expiry can be expressed either as the NotOnOrAfter attribute of the Conditions
element or as the NotOnOrAfter attribute of a suitable SubjectConfirmationDataelement. - The
element must contain at least on element that allows the authorization serve to confirm it as a Bearer Assertion. Such a element MUST have a Method attribute with a value of "urn:oasis:names:tc:SAML:2.0:cm:bearer". - The SubjectConfirmation
element MUST contain a SubjectConfirmationDataelement, unless the Assertion has a suitable NotOnOrAfter attribute on the element, in which case the element MAY be omitted. When present, the element MUST have a Recipient attribute with a value indicating the token endpoint URL of the authorization server (or an acceptable alias). The element MUST have a NotOnOrAfter attribute that limits the window during which the Assertion can be confirmed. The element MAY also contain an Address attribute limiting the client address from which the Assertion can be delivered. Verification of the Address is at the discretion of the authorization server. - The Assertion MUST have an expiry that limits the time window during
which it can be used. The expiry can be expressed either as the
NotOnOrAfter attribute of the Conditions
element or as the NotOnOrAfter attribute of a suitable SubjectConfirmationDataelement. - If the Assertion issuer authenticated the subject, the Assertion SHOULD contain a single
representing that authentication event. - If the Assertion was issued with the intention that the presenter act autonomously on behalf of the subject, an
SHOULD NOT be included. The presenter SHOULD be identified in the NameIDor similar element, the element, or by other available means. - Other statements, in particular
elements, MAY be included in the Assertion.
POST /token.oauth2 HTTP/1.1
Host: as.example.com
Content-Type: application/x-www-form-urlencoded
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&
assertion=PHNhbWxwOl...[omitted for brevity]...ZT4
4. Authorization Server validates the SAML token assertion and issues an access token back. Authorization Server does the SAML token verification as mentioned below.
- The Assertion will contain Conditions element with an AudienceRestriction element with an Audience element containing a URI reference that identifies the Authorization Server
and Authorization Server must verify the element. - The
element MUST contain a Conditionselement, unless the Assertion has a suitable NotOnOrAfter attribute on the element, in which case the element MAY be omitted. When present, the element MUST have a Recipient attribute with a value indicating the token endpoint URL of the authorization server (or an acceptable alias). The authorization server MUST verify that the value of the Recipient attribute matches the token endpoint URL (or an acceptable alias) to which the Assertion was delivered. The element MUST have a NotOnOrAfter attribute that limits the window during which the Assertion can be confirmed. The element MAY also contain an Address attribute limiting the client address from which the Assertion can be delivered. Verification of the Address is at the discretion of the authorization server. - The authorization server MUST verify that the NotOnOrAfter instant has
not passed, subject to allowable clock skew between systems. An invalid
NotOnOrAfter instant on the
element invalidates the entire Assertion. An invalid NotOnOrAfter instant on a SubjectConfirmationDataelement only invalidates the individual . The authorization server MAY reject Assertions with a NotOnOrAfter instant that is unreasonably far in the future. The authorization server MAY ensure that Bearer Assertions are not replayed, by maintaining the set of used ID values for the length of time for which the Assertion would be considered valid based on the applicable NotOnOrAfter instant.