XML format
SAML 2.0
A SAML 2.0 response carrying status and one or more identity assertions, usually signed and transported through a browser binding.
SAML separates protocol messages from assertions. A samlp:Response reports the outcome of an authentication request; its saml:Assertion describes the subject, issuer, conditions, authentication event, and optional attributes.
Correct XML is only the outer gate. Consumers must validate signatures, issuer, audience, destination, InResponseTo, and time conditions before trusting identity data, and must defend against signature-wrapping attacks when selecting the signed assertion.
- Protocol and assertion elements use different namespace URIs.
- IDs, destinations, recipients, audiences, and time windows must be checked against local expectations.
- A signature is meaningful only when the application consumes the exact element the signature covers.
- Base64 encoding used by a binding is transport wrapping, not part of the XML document itself.
- Root element
<Response>- Media type
application/xml- Extensions
.xml- Namespaces
urn:oasis:names:tc:SAML:2.0:protocolurn:oasis:names:tc:SAML:2.0:assertion
- XMLDir label
xml
Specification: OASIS SAML 2.0 Core
A minimal valid document
Every example on this site is checked against the same parser the workspace uses, so what you see below is known to be well-formed.
<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_response" Version="2.0" IssueInstant="2026-08-21T10:00:00Z">
<saml:Issuer>https://idp.example.com</saml:Issuer>
<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
<saml:Assertion ID="_assertion" Version="2.0" IssueInstant="2026-08-21T10:00:00Z">
<saml:Issuer>https://idp.example.com</saml:Issuer>
</saml:Assertion>
</samlp:Response>Namespaces you will meet
SAML 2.0 protocol
urn:oasis:names:tc:SAML:2.0:protocolThe namespace for SAML requests, responses, status codes, logout messages, and other protocol-level exchanges.
SAML 2.0 assertion
urn:oasis:names:tc:SAML:2.0:assertionThe identity-bearing half of SAML: assertions, issuers, subjects, conditions, authentication statements, and attributes.
XML Signature
http://www.w3.org/2000/09/xmldsig#Digital signatures embedded in the XML they sign. The namespace behind SAML assertions, signed SOAP messages and e-invoicing mandates.
Get started
Bring order to the XML your team can't afford to ignore.
Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.