Which statement describes SAML in federation?

• A. SAML uses XML-based assertions for authentication in enterprise SSO.
• B. OIDC uses XML-based tokens for authentication.
• C. OAuth 2.0 requires SAML for federation.
• D. SAML is deprecated in modern federations.

Answer: (A)

In federation, SAML is a standard for exchanging authentication data between an identity provider and a service provider, using XML-based assertions to prove a user’s identity for enterprise single sign-on. This is the best description because SAML assertions are the core mechanism that carries authentication statements (who the user is, who issued the assertion, conditions, and timing) from the IdP to the SP, typically with digital signatures to ensure trust. The user’s experience is seamless: log in once with the IdP and gain access to multiple services without re-entering credentials.

Other options don’t fit as well. OpenID Connect relies on tokens typically in JSON format (JWTs), not XML-based assertions, so describing it as XML-based authentication is inaccurate. OAuth 2.0 handles authorization flows and does not inherently require SAML for federation. And SAML is not deprecated in modern federations; it remains a widely used option alongside newer approaches.