Any entity which can authenticate some other entity (verify its identification) can probably act as an authentication authority and issue a SAML authentication assertion.
It is as much as depending parties, for instance a PDP, to determine what authentication authorities it chooses to consider.
The manner of making sure that the entity creating a request and the entity cited by an declaration are one and the equal is dependent on the surroundings and protocols being used.
The preferred mechanism furnished is the Subject Confirmation detail, which is meant to hold records appropriate to the surroundings. Possible mechanisms consist of an artifact encoded in a URL, a Kerberos service ticket, or a public key associated with signature on a record. SAML profiles will specify the details for unique conditions.It is expected that others besides the SAML Technical Committee will define other schemes appropriate for other environments. They would possibly or may not publish these as profiles, however doing so guarantees greater interoperability.
