Which option is the open standard for exchanging authentication data used in SSO across domains?

Which option is the open standard for exchanging authentication data used in SSO across domains?

• A. Security Assertion Markup Language (SAML)
• B. Cross-Certification
• C. Open Authorization (OAuth)
• D. Shibboleth

Answer: (A)

SAML, the Security Assertion Markup Language, is the open standard for exchanging authentication data to enable single sign-on across domains. It provides an XML-based framework that lets an identity provider confirm who a user is and what they’re allowed to access, then securely share that assertion with service providers. In a typical SSO flow, you try to access a service, you’re redirected to the identity provider for authentication, and once verified, the IdP issues a SAML assertion that the service provider accepts to grant access without re-authenticating. This cross-domain capability comes from the trusted exchange of these assertions, usually protected with digital signatures and sometimes encryption. Shibboleth is a common implementation that uses SAML to achieve this, while Cross-Certification is about establishing PKI trust, and OAuth focuses on authorization rather than authentication across domains. So the open standard you’re looking for is SAML.

SAML, the Security Assertion Markup Language, is the open standard for exchanging authentication data to enable single sign-on across domains. It provides an XML-based framework that lets an identity provider confirm who a user is and what they’re allowed to access, then securely share that assertion with service providers. In a typical SSO flow, you try to access a service, you’re redirected to the identity provider for authentication, and once verified, the IdP issues a SAML assertion that the service provider accepts to grant access without re-authenticating. This cross-domain capability comes from the trusted exchange of these assertions, usually protected with digital signatures and sometimes encryption. Shibboleth is a common implementation that uses SAML to achieve this, while Cross-Certification is about establishing PKI trust, and OAuth focuses on authorization rather than authentication across domains. So the open standard you’re looking for is SAML.