SAML: A fractal of bad design
summary
The SAML authentication protocol is fundamentally flawed due to its extreme complexity and reliance on problematic XML signatures, making it a liability for modern security. While it once enabled the growth of the single sign-on industry, its 'kitchen-sink' design and inability to adapt to mobile and zero-trust architectures make it obsolete. The industry should deprecate SAML in favor of OpenID Connect (OIDC), which is simpler, more agile, and better suited for current web standards.
key points
- SAML's reliance on XML leads to inherent security vulnerabilities like XML Signature Wrapping (XSW) and canonicalization bugs, which are frequently exploited by researchers to bypass authentication.
- The protocol suffers from a 'kitchen-sink' design where a vast majority of the specification is rarely used in practice, adding unnecessary complexity that increases the attack surface.
- Unlike SAML's rigid, upfront design, OpenID Connect (OIDC) evolved organically to support modern requirements such as mobile apps, SPAs, and HTTP-based transport, making it easier to implement securely.
who should read it
Security engineers, software architects, and IT decision-makers who manage authentication systems or choose between SSO protocols for their products.
discussion skeptical
consensus
Commenters overwhelmingly agree that SAML is a fundamentally broken and dangerous security specification, primarily due to its reliance on complex XML signatures. The general sentiment is that the standard is too flexible, leading to countless insecure implementations and critical vulnerabilities like signature wrapping. While OIDC is viewed as a superior alternative, some note it has its own flaws and that SAML persists in enterprise environments due to legacy requirements.
top insight
The most critical failure of SAML is not just the use of XML, but the decision to sign a potentially attacker-controlled subset of a document rather than the entire byte stream. This allows attackers to provide a valid signature for one part of a document while modifying other critical assertions, a vulnerability that is far more severe than simple syntax choices. This architectural flaw makes it nearly impossible for non-specialist firms to implement SAML securely.
Generated by an LLM from the article and thread. Check the sources before relying on it.