SAML
technicalFull Name: Security Assertion Markup Language
Definition
SAML (Security Assertion Markup Language) is an XML-based open standard developed by the OASIS Security Services Technical Committee for exchanging authentication and authorization data between parties, specifically between an identity provider (IdP) and a service provider (SP). SAML 2.0, released in 2005, became the dominant protocol for enterprise single sign-on and federated identity management, and is widely deployed across European government services, corporate environments, and the existing eIDAS cross-border authentication infrastructure. In the EUDI Wallet ecosystem, SAML represents the established identity protocol environment that the new wallet-based system must interoperate with during the transition period. While the EUDI Wallet natively uses modern protocols like OpenID4VP for credential presentation and OpenID4VCI for credential issuance, bridge services and proxy solutions enable smooth integration with the extensive SAML-based infrastructure that currently serves millions of European citizens and organizations.
SAML Architecture and How It Compares to EUDI Wallet Protocols
In the SAML model, three roles interact: the user (called the principal), the identity provider (IdP) that authenticates the user and issues SAML assertions, and the service provider (SP) that grants access based on the assertions received. When a user attempts to access a service, they are redirected to their IdP, authenticate there, and the IdP sends a signed XML assertion to the SP confirming the user's identity and attributes. This redirect-based flow means the IdP is aware of every service the user accesses, creating a central point of surveillance.
The EUDI Wallet model fundamentally differs in that the wallet acts as a user-controlled intermediary rather than relying on a centralized IdP. When a user presents credentials to a verifier, the credential issuer is not involved in the transaction and has no knowledge of where or when the credential is being used. This architectural difference eliminates the central tracking problem inherent in SAML and aligns with the eIDAS 2.0 privacy requirements that prohibit wallet providers and issuers from monitoring user activity.
SAML assertions are typically all-or-nothing: the IdP sends a predefined set of attributes to the SP, with limited ability for the user to control which attributes are shared. The EUDI Wallet's selective disclosure capability allows users to share only the specific attributes requested by the verifier, supporting GDPR's data minimization principle. For example, while a SAML assertion might include full name, date of birth, and national ID number, the EUDI Wallet can present just a proof of being over 18 without revealing any other personal information.
SAML in European Government Identity Systems
SAML has been the backbone of European cross-border digital identity since the original eIDAS Regulation of 2014. The eIDAS interoperability framework uses SAML-based eIDAS nodes deployed by each member state to enable cross-border authentication. When a German citizen needs to access a French government service, the authentication request passes through the French eIDAS node to the German eIDAS node via SAML, then to the German national eID system (using the German national identity card). The authentication result returns via the same SAML-based path.
Many national eID systems across Europe also use SAML for domestic authentication. The Italian SPID system, the Belgian eID, the Estonian ID-card system, and others all support SAML-based authentication for government services. Tens of thousands of government and private-sector service providers across the EU have integrated with these SAML-based national eID systems, representing a massive installed base that cannot be migrated overnight.
The EUDI Wallet rollout must account for this existing infrastructure. The Architecture Reference Framework defines bridge specifications that allow EUDI Wallet presentations to be translated into SAML assertions for consumption by existing service providers. These bridges enable a gradual migration where service providers can begin accepting EUDI Wallets alongside their existing SAML integrations, eventually phasing out the SAML path as the wallet ecosystem matures.
Migration Path from SAML to EUDI Wallet Protocols
The migration from SAML to EUDI Wallet-native protocols will follow a phased approach. In the first phase, proxy services will translate EUDI Wallet OpenID4VP presentations into SAML assertions that existing service providers can consume without modification. This allows citizens to use their EUDI Wallets immediately, even with services that only support SAML. In the second phase, service providers will add native OpenID4VP support alongside their SAML integrations, allowing both authentication methods to coexist.
In the third phase, as the EUDI Wallet reaches widespread adoption and the benefits of selective disclosure and decentralized verification become apparent, service providers will increasingly prefer native wallet integration over SAML. Government mandates requiring EUDI Wallet acceptance (under eIDAS 2.0) will accelerate this migration. In the final phase, SAML may be deprecated for citizen-facing identity services, though it may persist in enterprise-internal SSO scenarios where the EUDI Wallet's privacy advantages are less relevant.
Throughout this migration, maintaining interoperability and preventing service disruptions is paramount. The EUDI Wallet framework includes conformance testing suites for SAML bridge implementations, ensuring that the translation between protocols preserves security guarantees and does not introduce vulnerabilities. The European Commission's technical working groups actively collaborate with SAML implementers and EUDI Wallet developers to ensure a smooth coexistence path.