← Course Home
Okta Certified Administrator · Part I

Identity and Access Management

36% of the exam — the single largest domain.

Identity & Access Management

Module 2: Single Sign-On (SSO) Federation

4 sub-topics · this deck covers sub-topic 2 of 4

↑ Module 2 Overview

The Exam Bullet

"Demonstrate understanding of the SAML assertion"

Once an IdP verifies who someone is, it has to actually tell the service provider that, in a format both sides agree on. That message is the SAML assertion — this sub-topic is about what's actually inside it.

The Mechanism

A SAML assertion is an XML file with three statement types: authentication, attribution, and authorization. The identity provider sends it to the browser, which passes it along to the service provider.

The Three Statement Types

Authentication Statement — records when and how the user was verified.

Attribution Statement — carries user details like group membership and organizational role.

Authorization Statement — specifies the user's permission level across resources.

Okta's Two Roles

Okta can sit on either side of this exchange, and the exam expects you to know both:

As Identity Provider (IdP) — Okta authenticates the user and delivers the SAML assertion to an external app, enabling SSO while still supporting MFA.

As Service Provider (SP) — Okta consumes authentication from an external IdP like IBM Tivoli or Oracle Access Manager, redirecting the user there and validating whatever assertion comes back.

Why This Matters

Organizations favor SAML because it reduces the attack surface while improving the sign-in experience — one protocol carries both authentication and authorization together.

This is also why Submodule 1's "Okta as SP" setup depends entirely on this assertion format — inbound SAML only works because both sides agree on what the assertion contains.

The Exam Angle

Watch for scenario questions built around these traps:

→ "Which part of the assertion carries group membership?" = the Attribution Statement.

→ "Okta needs to authenticate against IBM Tivoli." = Okta acting as Service Provider, consuming that IdP's assertion.

One Line To Remember

SAML assertion = XML with 3 statements (authentication, attribution, authorization). Okta as IdP sends assertions out; Okta as SP consumes them from external IdPs like IBM Tivoli or Oracle Access Manager. One protocol, both authN and authZ — that's why it reduces attack surface.

Sources: help.okta.com — apps-about-saml.htm