A signature contains SignedInfo (canonicalization method, signature method and one Reference per signed item, each with transforms and a digest), SignatureValue and usually KeyInfo with an X.509 certificate. Enveloped signatures sit inside the element they sign (SAML assertions), detached ones point elsewhere. Exclusive XML Canonicalization (http://www.w3.org/2001/10/xml-exc-c14n#) normalizes namespaces and whitespace so that semantically equal XML hashes the same.
The flexibility is the danger: references by ID attributes, XPath transforms and canonicalization rules let verifiers and applications disagree about what was signed. Signature wrapping, comment-handling bugs and XML external entity attacks have repeatedly broken SAML and SOAP implementations. XAdES (ETSI EN 319 132) builds long-term electronic signatures on XML-DSig.