SAML2 Overview

SAML 2.0 (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between parties. It enables Single Sign-On (SSO), allowing users to authenticate once and access multiple services.

A SAML flow involves two parties:

1. User attempts to access a Service Provider (e.g., AWS Console)
2. Service Provider redirects to the Identity Provider
3. Identity Provider authenticates the user
4. Identity Provider sends a signed assertion back to the Service Provider
5. Service Provider validates the assertion and grants access

SplitSecure acts as a SAML 2.0 Identity Provider with a critical difference: authentication requires threshold approval from your team.

When you authenticate through SplitSecure:

1. You initiate login to a Service Provider
2. SplitSecure creates an authentication proposal
3. Team members approve on their mobile devices
4. Once threshold is reached, SplitSecure signs the SAML assertion
5. You gain access to the Service Provider

Unlike traditional identity providers, no human — including SplitSecure operators — ever has access to your signing keys. When your team approves a SAML assertion, shares are sent to a Secure Environment where the signing key is reconstructed ephemerally, used to sign the assertion, and immediately discarded.

Each team member’s cryptographic share is generated and stored exclusively on their device. When shares are transmitted to the Secure Environment for signing, they are always encrypted with perfect forward secrecy. The reconstructed secret exists only during computation and never leaves the Secure Environment.

Because SplitSecure never possesses any share of your signing keys, we cannot grant ourselves — or anyone else — access to your resources. This is a fundamental architectural difference from traditional PAM providers, who typically retain the ability to access customer systems for support or recovery purposes.

Before configuring SAML integrations, you need:

1. SplitSecure mobile app installed and set up
2. Web Companion paired with your mobile app
3. A team created in SplitSecure

If you haven’t completed these steps, see the Getting Started guides.

1. Create a SAML2 Identity Provider — Set up your IdP in SplitSecure
2. Configure Service Providers — Use the integration guides below to connect your services