Yes, we implemented our own dsig.
In fact, I wrote the kernel of the IdP after writing my own SAML test suite (after being horrified by the quality of SAML client libraries). I'm very happy to compare notes!
In fact, I wrote the kernel of the IdP after writing my own SAML test suite (after being horrified by the quality of SAML client libraries). I'm very happy to compare notes!
Agree that SAML is godawful (to put it lightly) and also very curious about your from-scratch implementation. I assume that by "crazy deps" you're referring to xmlsec1 (which, disturbingly, nearly every non Java/.NET library uses) Did you implement XML-DSig yourself? (!)
I'd be very interested in comparing notes on test cases. I wrote a SAML testing tool [1][2] inspired by the "On Breaking SAML" paper [3] but the tool is incomplete and essentially abandoned because I hoped that people would stop implementing SAML.
Would you be open to comparing notes on test suites for SAML implementations?
Footnotes:
1: http://saml.oktadev.com/
2: https://bitbucket.org/jfranusic/saml-messenger
3: https://www.usenix.org/system/files/conference/usenixsecurit...