News for hackers. Stuff that matters.

A comment on SAML: A Fractal of Bad Design. Parent comment

Re:SAML: A Fractal of Bad Design by koolba on Tuesday September 22, 2026 @06:32PM (#49809200)
The root problem with SAML is there’s a million and one permutations to do the same thing.

Signed assertions. Signed messages. Encrypted messages. Encrypted assertions. Sign after normalization. Sign before normalization. Encrypt then sign. Sign then encrypt.

There’s too many ways to do too many things.

[ Parent | on HN ]
Re:SAML: A Fractal of Bad Design by pseudohadamard on Wednesday September 23, 2026 @04:20AM (#49813091)
That's because its built in part on XMLDSig, a genius idea to sign active content that can redefine its own semantics as it's being signed/verified. It's a triumph of ideology over common sense.
[ Parent | on HN ]
Re:SAML: A Fractal of Bad Design by arethuza on Wednesday September 23, 2026 @04:57AM (#49813359)
I think I got to the canonicalization part of the relevant spec and decided that life was too short...

NB I can absolutely see why canonicalization is required... just that it was the bit where I lost interest

[ Parent | on HN ]