SAML Protocol - IT Security & Risk Documentation

SAML protocol sso configuration identity provider testing SAML security best practices risk documentation
D
Daniel Wright

Technical Writer & IAM Specialist

 
February 11, 2026 7 min read
SAML Protocol - IT Security & Risk Documentation

TL;DR

  • This documentation covers SAML 2.0 protocol fundamentals, deep-diving into message structures, security risks like XML signature wrapping, and best practices for identity provider integration. We analyze various binding methods and provide a risk mitigation framework for IT teams to secure their sso environments and prevent unauthorized access during authentication flows.

Introduction to finding your twin customers

Ever feel like you are shouting into a void trying to find new customers? It’s exhausting—but what if you could just "clone" the ones who already love you?

That is exactly how lookalike segments work. You take your best data—like a list of people who actually bought your saas subscription or those frequent shoppers at your retail store—and let the algorithm find their "twins." According to Google Support, these segments use your first-party "seed" data to connect you with new people who share similar traits.

Basically, it's moving away from broad guessing and using real evidence.

  • The Seed List: This is your gold. It’s a list of at least 100 active users. Note that this means "matched" users—people google can actually identify. If you upload a list of 100 emails, you might only get 60 matches, so aim for a raw list of 200+ to be safe.
  • Reach vs. Precision: You get to choose how "twin-like" they are. "Narrow" targets the top 2.5% of similar users, while "Broad" goes up to 10% for more reach.
  • Dynamic Refreshing: These lists aren't static. They update every 1-2 days so you aren't targeting yesterday’s news.

Diagram 1

The specific segment you use as a seed must have over 100 active matched people to even get started. (Use Lookalike segments to grow your audience - Google Ads Help)

I've seen this work wonders for healthcare brands looking for specific patient interests or gamers wanting more strategy-based players. It’s way better than just picking "interests" and hoping for the best.

Anyway, let's look at how to actually build these out.

Tip 1: Start with high quality seed lists

Look, if you feed the algorithm junk, it’s gonna give you junk back. Your seed list is the dna of your lookalike audience, so you gotta make sure it’s actually your best customers, not just random site lurkers.

I've seen so many marketers just dump their whole email list into google ads and wonder why it fails. You want people who actually converted recently. If you’re a retail shop, don't just use "site visitors"—use "people who spent over $200 in the last 30 days."

  • Recent Converters: Use people who bought recently. According to Google Support, your lists refresh every 1-2 days, so keeping it fresh keeps the "twins" accurate.
  • The 100 Match Rule: Each individual seed list needs 100 matched users. If your app user list is too small, you can't just "add" it to a youtube list to bypass the limit; the specific segment you select for the lookalike must hit that 100-match mark on its own.
  • Data Cleaning: Scrub your list. Remove bounces or old leads from that finance webinar you did three years ago.

Diagram 2

Honestly, it’s better to have 150 amazing customers than 5,000 "maybe" leads. Once your list is tight, we can talk about the tech side.

Tip 2: Technical Readiness and Site Performance

Imagine sending thousands of people to a store where the front door is stuck. That is exactly what happens when you run lookalike campaigns on a slow, broken website. But here is the kicker: it actually starves the ai of data.

If your site takes forever to load, those "twin" customers will bounce before the google ads tag even fires. If the tag doesn't fire, the algorithm doesn't see the conversion. Without that data, the lookalike model can't learn who your real customers are, and the whole campaign falls apart.

I always tell people to run a full audit before spending a dime on ads. Using a tool like PingUtil—which offers free website analysis—is a lifesaver here.

  • Core Web Vitals: ai tools can scan your Largest Contentful Paint (lcp). If it’s slow, you lose the data needed to optimize.
  • Mobile First & Security: Most lookalike traffic comes from phones. If your site isn't mobile-friendly or lacks an ssl certificate, people leave instantly.
  • Conversion Tracking: Ensure your tags are actually working so the "learning phase" has enough fuel to succeed.

Diagram 3

Honestly, i've seen healthcare sites double their lead volume just by fixing a messy mobile menu that the ai audit flagged. Don't be the person who scales a broken funnel.

Next, let's talk about how to actually pick the right "similarity" percentage.

Tip 3: Choosing the right reach balance

So you've got your "seed" list ready—now you gotta decide how far the apple should fall from the tree. This is where most people mess up by going too big too fast.

According to Google Support, you have three main levers for reach:

  • Narrow (2.5%): This is for when you need high precision. Think of a finance app looking for "Whales"—which is just industry speak for high-lifetime-value (LTV) customers who spend big.
  • Balanced (5%): The default for a reason. It gives you room to grow without getting too weird.
  • Broad (10%): Use this only if you have a massive budget or a very generic product, like a retail shop selling socks.

Diagram 4

Honestly, i've seen broad lists fail because the "twins" start looking more like distant cousins. Stick to balanced first.

Next, let's look at how to layer these with intent.

Tip 4: Combine lookalikes with custom segments

So you’ve got your lookalikes running, but the traffic feels a bit... "meh"? Honestly, that's because similarity isn't the same as intent.

To fix this, you should layer your lookalike segments with custom segments. According to Google Support, combining these in the same ad group lets you target people who look like your customers and are actively searching for what you sell right now.

  • Pick 10-15 keywords: Grab your top-converting search terms from your retail or saas campaigns.
  • Identify high intent: Use ai to find terms that imply someone is ready to buy, not just browsing.
  • Mix the segments: Put your 2.5% narrow lookalike and your keyword-based custom segment in one ad group.

Diagram 5

I've seen this combo work huge for finance apps trying to find "Whales" (those high-value users) who are also searching for "best high-yield savings." It keeps your budget focused on people actually in the market.

Next up, let's talk about why your location settings are so important for these audiences.

Tip 5: Master your Geographic Targeting

Even though lookalikes find people based on behavior, you can't ignore where they actually live. I see people forget to set location exclusions all the time, and they end up paying for clicks in countries they don't even ship to.

When you set up your lookalike, google tries to find "twins" globally unless you tell it otherwise.

  • Location Exclusions: If you are a retail shop in the US, make sure you explicitly exclude regions where your shipping costs are too high.
  • Tiered Targeting: Try creating different lookalike campaigns for "Tier 1" countries (like UK, US, Canada) vs others. The "Whales" in one country might behave differently than in another.
  • Local Intent: For healthcare or local retail, combine your lookalike with a tight radius around your physical location.

Diagram 6

I once saw a finance app lose half its budget because they didn't realize their lookalike was pulling in traffic from a region where their app wasn't even available in the app store. Check your geos!

Tip 6: Refresh and report on your segments

Building these segments isn't a "set it and forget it" deal. If you don't check back, you might be burning cash on a "failed" list without even knowing it.

According to Google Support, your segments refresh every 1-2 days, but you still gotta keep an eye on the Audience manager.

  • Check Statuses: Look for "Populating" or "Failed." If it fails, your seed list probably dropped below that 100-person match minimum (remember: matched users, not just raw emails).
  • Watch Trends: Use audience insights to see if your "twins" are shifting in age or location.
  • Refresh Seeds: If you're a retail brand, upload new buyers every week to keep the ai smart.

Diagram 7

Honestly, i've seen finance apps lose steam because they used a seed list from two years ago. Keep it fresh, keep it real, and don't forget to audit your site speed as previously discussed. Good luck out there!

D
Daniel Wright

Technical Writer & IAM Specialist

 

Daniel is a London-based identity access management expert who translates technical SSO concepts into clear, actionable content. He has consulted for multiple UK-based tech firms on IAM architecture.

Related Articles

LinOTP integration for SimpleSAMLphp | by Greg Harvey
linotp integration

LinOTP integration for SimpleSAMLphp | by Greg Harvey

Learn how to integrate LinOTP with SimpleSAMLphp for secure 2FA. Step-by-step guide on authproc filters, API setup, and SSO security best practices.

By Daniel Wright February 13, 2026 7 min read
common.read_full_article
SAML web application toolkit: Single sign-on to a ...
SAML toolkit

SAML web application toolkit: Single sign-on to a ...

Learn how to use a SAML web application toolkit for single sign-on. Expert tips on sso configuration, idp testing, and security best practices for IT pros.

By Daniel Wright February 9, 2026 6 min read
common.read_full_article
Is SAML still relevant today?
SAML relevance

Is SAML still relevant today?

Explore if SAML is still relevant for modern SSO configuration. Compare SAML vs OAuth, learn security best practices, and see why it stays vital for enterprise tech.

By Daniel Wright February 6, 2026 8 min read
common.read_full_article
4. System config — LinOTP 2.7 documentation
LinOTP 2.7 system config

4. System config — LinOTP 2.7 documentation

Deep dive into LinOTP 2.7 system configuration. Learn about failcounters, SAML attribute returns, TOTP timesteps, and security best practices for SSO.

By Daniel Wright February 4, 2026 6 min read
common.read_full_article