SAML: A Fractal of Bad Design

authentication , vulnerabilities Page content SAML and the birth of the SSO industry A crack in the armor A fractal of bad design Built on XML Canonicalization Enveloped signatures “Kitchen-sink” design Ossification All roads lead to OIDC Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it's time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning single sign-on (SSO) industry fulfilled this need. However, SAML is being crushed under the weight of its own complexity. It’s time to deprecate it and move on to modern alternatives like OpenID Connect (OIDC).