SAML: A fractal of bad design
The gist
Trail of Bits published "SAML: A fractal of bad design" by Matt Schwager on Sep 21.
The post argues the 2002 authentication protocol should be deprecated in favor of OIDC.
How it unfolded
- 2002SAML is created by the OASIS Security Services Technical Committee; four XML-based security protocols are contributed and merged into one specification.
- 2003Shibboleth IdP is released by Internet2, and ADFS by Microsoft.
- 2023Thomas Ptacek is quoted saying XML signature validation, which SAML depends on, is deeply cursed and that most fielded implementations wrap libxmlsec.