•

Passing user credentials over the Internet provides more opportunity for the Eve's of the world to capture and decode your passwords and match other PII with privileged credentials. Just like HTML is a derivative of XML for building web pages, SAML is a derivative of XML for performing authentication.

The SAML specification (created by OASIS) defines a standard for identifying a user across domains. This means, if a user has been authenticated by some other resource (for example Microsoft's Active Directory), that resource can tell another resource (for example, a sales web application) the identity of the user. This means the application developer isn't responsible for authentication and storage of sensitive logon information.

By delegating the username and password challenge, the application only needs to ‘ask’ the other resource for the identity of the user to provide the correct experience. This is the trust or claims-based form of authentication.