SAML: A Fractal of Bad Design
SAML, the enterprise SSO workhorse, receives a brutal technical post-mortem detailing its inherent "fractal of bad design" due to XML complexity, signature flaws, and ossification. This deep dive into protocol design failures and the compelling case for OIDC offers a delicious critique of legacy tech that HN regulars will savor.
The Lowdown
SAML, a long-standing but deeply flawed authentication protocol, is deemed a "fractal of bad design" by Trail of Bits. Despite its ubiquity in corporate IT and its role in birthing the SSO industry, the article argues for its urgent deprecation in favor of modern alternatives like OpenID Connect (OIDC), citing its fundamental complexity and security vulnerabilities.
- Committee-Driven Origins & XML Foundation: SAML was born from a committee merging several XML-based security protocols in 2002, inheriting XML's inherent complexity (tags, namespaces, schemas) which is antithetical to security.
- Early Adoption & Industry Impact: It became crucial for Web 2.0, driven by academic institutions and later foundational to the rise of SSO providers like Okta, despite its underlying architectural weaknesses.
- Inherent Flaws: The author details five fatal flaws:
- XML Dependency: XML's complexity leads to a host of security vulnerabilities (XXE, entity expansion) even before SAML logic.
- Canonicalization Challenges: The difficulty in consistently representing XML data for signature validation (canonicalization) is a constant source of parser differential and "round-trip" bugs, enabling attacks like XML signature wrapping (XSW).
- Enveloped Signatures: Embedding the signature within the signed data payload makes consistent byte-for-byte signing extremely difficult and error-prone, unlike detached signatures in JWT.
- "Kitchen-Sink" Design: SAML's broad, committee-driven specification includes numerous unused features, adding unnecessary complexity and increasing the attack surface, contradicting the "You Aren't Gonna Need It" principle.
- Ossification: Designed for an era before HTTP/TLS dominance and connected network topologies, SAML has failed to adapt to modern web, mobile, and IoT environments, unlike OIDC's organic and agile evolution.
- The Path Forward: OIDC: The article posits that OpenID Connect (OIDC) is the superior, more secure, and agile alternative, having evolved organically to meet modern needs and simplify authentication with a connected network assumption.
While acknowledging SAML's significant historical impact and its role in shaping the SSO industry over a 25-year run, the author concludes that it now serves as a critical case study in protocol design failures, advocating for service providers and identity providers to migrate to OIDC.