SAML single sign-on as service provider
Key Takeaway
Salesforce, as the service provider, validates the identity provider's signed SAML response before it logs a user in, so the SAML single sign-on setting you create must match exactly what the identity provider sends.
With SAML single sign-on (SSO), a Salesforce org or Experience Cloud site can act as the service provider, which is the app users want to reach. An external identity provider confirms who the user is and sends Salesforce a signed SAML response, so users log in with the identity provider's credentials. As an admin, you build a SAML single sign-on setting in Salesforce that matches exactly what the identity provider sends.
Identity provider, service provider, and SAML
When Salesforce is the service provider, the identity provider sends Salesforce a SAML response. Inside the SAML response is the SAML assertion, which states facts about the user, such as the username or email address. The identity provider signs the assertion. Salesforce validates the signature before it logs the user in.
Salesforce checks the signature on the response body first. If that signature is missing or invalid, Salesforce tries the signature on the assertion instead. So even if an attacker tampers with the response body in the browser, the login is not at risk as long as the assertion signature is intact.