I finally understood SAML after explaining it in plain English

For a long time, SAML felt unnecessarily complicated to me.

Every explanation started with terms like:

• Identity Provider (IdP)
• Service Provider (SP)
• SAML Assertion
• XML Signatures

...and somehow made it even more confusing.

The explanation that finally made it click was this:

Once I understood that, everything else started to make sense.

While learning it, I put together a guide that covers:

• What SAML actually is (without assuming prior knowledge)
• Why enterprises still use it
• Identity Provider vs Service Provider
• How SAML Single Sign-On works step by step
• What's inside a SAML Assertion
• SAML vs OAuth 2.0 vs OpenID Connect
• How SAML fits into API architectures with Apigee
• Common interview questions around SAML

I tried to avoid jargon and explain everything with practical examples instead of diving straight into XML.

If anyone is currently learning SAML or preparing for API/security interviews, I'd love to hear your feedback.

Blog: link

Also curious—what was the hardest identity/authentication concept for you to understand at first? SAML, OAuth, OpenID Connect, JWT, Kerberos, or something else?