Re:SAML Is Insecure by Design
by rkeene2 on Thursday August 05, 2021 @07:32PM
(#28081424)
I implemented a SAML IdP from the spec and it wasn't too difficult to get through (I implemented everything including the XML parser, XML DS (Digital Signature), XML C14N (Canonicalization), RSA implementation). I did take some shortcuts in the IdP part which just needs to produce but not validate XML DS (unless you're supporting signed requests).
[ Parent
| on HN ]
URL for it: https://github.com/rkeene/saml-idp
This is actually something I hadn’t really considered before. Writing an IdP is in many ways probably much easier than writing a service provider because there are many fewer knobs you need to turn. Not none, but fewer. You probably have one template for assertions that contains all the clauses and conditions you care about and you set them all every time.
Clients can be much harder because you can any number of combinations of instructions thrown your way and you have to respect their intent. This is much harder to deal with.