SAML: A fractal of bad design
Security research argues SAML is a legacy protocol with fundamental design flaws and should be deprecated for OpenID Connect.
A Trail of Bits blog post critiques the Security Assertion Markup Language (SAML) authentication protocol, highlighting its complex, committee-driven design and persistent security vulnerabilities like XML Signature Wrapping (XSW) attacks. The author argues that SAML's foundation on XML and its implementation complexity have led to widespread security issues. The post advocates for deprecating SAML in favor of simpler, modern alternatives like OpenID Connect (OIDC).
- SAML is a legacy authentication protocol with a history of complex design and security flaws.
- XML Signature Wrapping (XSW) attacks have been a known vulnerability since 2012.
- The protocol's complexity makes it prone to implementation errors.
- The author advocates for deprecating SAML in favor of modern alternatives like OpenID Connect.
- Products
- SAMLOpenID Connect
- Organizations
- Trail of Bits
From the original article
11 min read at blog.trailofbits.com
Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services.
By blog.trailofbits.com via fanf · blog.trailofbits.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.