Page 989 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Administrators manage these details behind the scenes and the
process is usually transparent to users. Users don’t need to enter their

credentials again.

A challenge with multiple companies communicating in a federation is
finding a common language. They often have different operating
systems, but they still need to share a common language. To solve this
challenge, federated identity systems often use the Security Assertion
Markup Language (SAML) and/or the Service Provisioning Markup

Language (SPML). As background, here’s a short description of some
markup languages.

Hypertext Markup Language Hypertext Markup Language
(HTML) is commonly used to display static web pages. HTML was
derived from the Standard Generalized Markup Language (SGML) and
the Generalized Markup Language (GML). HTML describes how data
is displayed using tags to manipulate the size and color of the text. For

example, the following H1 tag displays the text as a level one heading:
<H1>I Passed The CISSP Exam</H1>.

Extensible Markup Language Extensible Markup Language
(XML) goes beyond describing how to display the data by actually
describing the data. XML can include tags to describe data as anything
desired. For example, the following tag identifies the data as the
results of taking an exam: <ExamResults>Passed</ExamResults>.

Databases from multiple vendors can import and export data to and

from an XML format, making XML a common language used to
exchange information. Many specific schemas have been created so
that companies know exactly what tags are being used for specific
purposes. Each of these schemas effectively creates a new XML
language. Some common languages used for federated identities are
listed here.

Security Assertion Markup Language Security Assertion

Markup Language (SAML) is an XML-based language that is
commonly used to exchange authentication and authorization (AA)
information between federated organizations. It is often used to
provide SSO capabilities for browser access.