A SAML assertion is an XML document that an Identity Provider (IdP) sends to a Service Provider (SP). This document contains statements about a user (the subject). These statements are the core data being transferred and typically include information about the user's authentication status, attributes (like email or group membership), and authorization decisions. Therefore, the assertion itself defines the content of the data being exchanged in a SAML transaction. The other components—protocol, binding, and profiles—define the "how" and "where" of the exchange, not the "what" (the data content).

A. protocol: A SAML protocol defines the structure of request and response messages used to ask for and receive assertions, not the content of the assertion itself.
C. binding: A SAML binding specifies how SAML protocol messages are mapped onto underlying transport protocols like HTTP POST or Redirect, defining the transport method, not the data.
D. profiles: A SAML profile describes a specific use case (e.g., Web Browser SSO) by combining assertions, protocols, and bindings. It is a framework, not the data content.

1. OASIS Security Services Technical Committee. (2005). Security Assertion Markup Language (SAML) V2.0 Technical Overview. OASIS Committee Draft. Section 2.2

"SAML Assertions

" page 7

lines 243-245. "A SAML assertion is a package of information that supplies one or more statements made by a SAML authority... The following kinds of statements are defined in SAML: Authentication

Attribute

Authorization Decision."

2. Cisco. (2021). SAML SSO Deployment Guide for Cisco Unified Communications Applications

Release 12.5(1)SU4. Chapter: SAML SSO Solution

Section: SAML SSO Solution Components. This guide states

"SAML Assertions—The IdP sends a SAML assertion to the service provider. The assertion contains a message that the user is authenticated."

3. OASIS Security Services Technical Committee. (2005). Profiles for the OASIS Security Assertion Markup Language (SAML) V2.0. OASIS Standard. Section 2

"SAML Concepts

" page 9

lines 260-261. "An assertion is a package of information that supplies one or more statements made by a SAML authority."