SAML: A Fractal of Bad Design
“SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a…
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
SAML is insecure by design joonas.fi
Not only weird, SAML is also insecure by design, as it relies on signatures based on XML canonicalization, not XML byte stream. Which means you can exploit XML parser/encoder differences.
-
The Difficulties of SAML Single Logout shibboleth.atlassian.net
On the technical and UX issues of single logout implementations.
-
SAML vs. OAuth web.archive.org
“OAuth is a protocol for authorization: it ensures Bob goes to the right parking lot. In contrast, SAML is a protocol for authentication, or allowing Bob to get past the guardhouse.”
-
The Beer Drinker's Guide to SAML duo.com
SAML is arcane at times. A another analogy might helps get more sense out of it.
-
Shadow Linking: The Persistence Vector of SaaS Identity Threat obsidiansecurity.com
Abuse of additional identity providers to persist in an environment.
-
The SSO Wall of Shame sso.tax
A documented rant on the excessive pricing practiced by SaaS providers to activate SSO on their product. The author's point is, as a core security feature, SSO should be reasonably priced and not part of an exclusive tier.
IAM › SAML: ““SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a…”