![](bg5.png)
Concerning the different types of used SAML pro-
files we limit our evaluation to the profiles offered by
SAML version 2.0, as only two profiles are standard-
ized in the versions 1.0 and 1.1. SAML 2.0 provides
13 standardized profiles in total where only seven are
used over all Member States. The most popular pro-
file constitutes the Web Browser SSO Profile which
is implemented by six countries. The country, which
bases its eID implementation on the most profiles,
is Belgium with eight deployed planned profiles (all
SAML versions). All other countries use or plan to
use between one and four standardized profiles. The
average profiles used per country are 2.66.
In comparison, the average number of SAML
bindings used per country is 2.4. The number of bind-
ings per country is nearly equally distributed, reach-
ing from one to four bindings per country, having
again Belgium leading together with Slovenia. The
most common binding is the HTTP Post Binding with
seven mentions, followed by the HTTP Redirect Bind-
ing with five, the SAML SOAP Binding with four, and
the HTTP Artifact Binding with three. All those bind-
ings refer to the SAML 2.0 specifications. As only
few countries still use earlier SAML versions we skip
again a detailed analysis on them.
Additionally, all countries rely on SAML proto-
cols for the transport of SAML assertions. Again,
Belgium uses the most predefined SAML protocols,
namely four. All other countries rely on between one
and three out of the box protocols. The most popular
protocol is the Assertion Query and Request Protocol
in version 2.0 succeeded by the Authentication Re-
quest Protocol, the Artifact Resolution Protocol and
the Single Logout Protocol. Taking profiles, bind-
ings, and protocols together, all countries just rely on
predefined SAML components and did not implement
any country specific solution for SAML adoption.
Digging a little bit deeper into the modular SAML
architecture, after analyzing profiles, bindings, and
protocols we evaluated the use of SAML assertions
and its statements. Nearly all responding countries
(87.5%) have an authentication statement included
in their assertion (except Austria). Thereby, for au-
thentication different authentication methods are in-
voked in all countries, reaching from simple user-
name/password mechanisms to more secure and high
sophisticated smart card and PKI based solutions. In
contrast to that, all participating countries include at
least one attribute statement in their assertion. Bel-
gium, Italy and the UK even include more than one.
In our questionnaire, we also asked which kind of and
how many attributes are wrapped in an attribute state-
ment. Most countries use SAML assertions only for
identification of natural persons (in Austria, France,
and Spain legal persons can also be authenticated in
the national eID infrastructure), hence the most com-
mon attributes are a unique/sectoral identifier, first
name, last name, and date of birth. Regarding the
maximum number of attributes (mandatory or op-
tional) within an attribute assertion, UK’s assertion
can take up to nine attributes, Autria’s seven, and
Italy’s six. The average number of attributes in one
assertion is 4.75.
Concerning section 2, besides authentication and
attribute statements also authorization statements can
be incorporated in a SAML assertion. However, this
feature is rarely used amongst the participating coun-
tries. Only Belgium is planning to regulate access
control using this SAML possibility.
All Member States take care about the security of
the identification and authentication data transmitted.
In fact, all countries sign their SAML assertion using
XML-DSig as signature syntax and processing algo-
rithm. However, in contrast no country actually en-
crypts the assertion. Also no encryption algorithm is
used for encrypting single attributes. To additionally
improve security, SAML assertions have only a cer-
tain period of validity. However, this validity period
greatly varies between the Member States, reaching
from 5min (Belgium, France, and Spain) to a couple
of hours (Iceland and UK) or even severaldays (Italy).
5 CONCLUSIONS
The aim of the work carried out in this paper was to
prove if SAML is also a dominant standard for ex-
changing identification and authentication data in na-
tional eID concepts across the European Union. To
verify this, a questionnaire containing general ques-
tions to the national eID infrastructure and addition-
ally more detailed questions regarding the structure
of SAML components (profiles, bindings, protocols,
and assertions) was sent out to all 14 partners of the
STORK project in its early phase. All partners repre-
senting a Member State replied to this questionnaire,
hence the evaluation of those questionnaires is based
on a response rate of 100%. Based on these results
and findings, SAML can be seen as an important stan-
dard in the field of eID across Europe. The prevalence
of SAML amongst the interviewed Member States led
also STORK to set up its interoperability framework
for cross-border identification and authentication on
SAML 2.0. According to the findings resulting from
the described empirical study, the Web Browser SSO
Profile and the HTTP Post Binding were chosen as
basic SAML components as they are used most fre-
quently. Although the Assertion Query and Request
THEPREVALENCEOFSAMLWITHINTHEEUROPEANUNION-AnEmpiricalStudy
575