Trail of Bits: SAML is a 'fractal of bad design,' time to deprecate it
Security firm argues the 24-year-old authentication protocol should be retired in favor of OpenID Connect due to design-by-committee complexity.
What to know
- SAML, created in 2002 by merging four XML security protocols, has become a security liability due to its complexity and XML-based architecture, according to Trail of Bits.
- A documented pattern of vulnerabilities—from canonicalization flaws (2018) to GitHub Enterprise auth bypasses (2025)—traces back to SAML's foundational design choices.
- Trail of Bits advocates for deprecating SAML in favor of OpenID Connect (OIDC), a simpler modern alternative.
Trail of Bits Security research firmThomas Ptacek Security researcher (quoted 2023)OASIS Security Services Technical Committee Standards body
How it unfolded 1 development · click the chart to see its coverage articlesposts
-
1
Trail of Bits publishes argument for SAML deprecation
Security firm Trail of Bits publishes an analysis titled 'SAML: A Fractal of Bad Design' arguing that SAML is 'being crushed under the weight of its own complexity' and should be deprecated in favor of OpenID Connect (OIDC). The post examines SAML's design-by-committee origins, its progression through academic and corporate environments, and the security vulnerabilities that have resulted from its XML-based architecture.
“SAML is being crushed under the weight of its own complexity. It's time to deprecate it and move on to modern alternatives like OpenID Connect (OIDC).”
— Trail of Bits -
2 outlets SAML: A fractal of bad design
first by HN Best, 1d ago · also HN Frontpage
-
It's called design by committee. It's when you get everyone in a room and nobody can make a tradeoff because it would hurt someone else's pet use case, so you don't actually design anything at all, just build a framework within which a design can exist.Anyone who has used Wireguard and OpenVPN will spot the difference. OpenVPN is the…
2 more of the top 3 · 26 posts in this stretch
-
T
SAML was created in 2002 by merging four rival XML security protocols into one spec. That design still generates vulnerabilities: a canonicalization flaw via XML comments in 2018, XML round-trip bugs in Go's stdlib in 2020, a GitHub Enterprise SAML auth bypass in 2025, and more. Matt Schwager breaks down 5 design flaws behind the pattern and makes…
-
Re: canonicalization: design things to not need it, so don't bother with it. Relying parties need to received the blob of whatever (XML, JSON, DER, PB -- don't care or decode till the signature is validated), validate the signature over the exact blob you've received, then decode. This means you need the signing key's algorithm to be identifiable…
-
-
background
OASIS creates SAML by merging four XML security protocols — The Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee creates SAML as an XML-based markup language for security assertions, combining four separate XML-based security protocols into a single specification.
What people are saying 21 voices from 2 sites · best of 26 · verbatim
- Yesterday
-
JWT uses a famously misdesigned signature scheme. It’s kind of amazing that this article uses JWT as an example of being better than SAML — SAML really is awful!
-
SAML is XML era legacy so mostly ugly but it's just the form of it. But all the security problems come from XMLDSIG which is just the worst signature scheme ever designed. So much complexity for so few to deliver. Just sign a bunch of bytes.
-
Just shipped another SAML integration; pretty sure I lost a few years off my life. The XML signature bits always get me.
-
The deeper you dig into SAML, the more arbitrary complexity you uncover. Each layer reveals another baffling design choice.
-
Ah, SAML. The protocol where every vendor implements it slightly differently, ensuring endless configuration headaches.
-
"... it’s not the committee’s fault. XML is what they had at the time, and it’s what people used. JSON was “discovered” in 2001 ..."The committee had, at the very least, ASN.1. Not text, but any digital signature scheme has to be machine readable, not human readable.
-
My goto when integrating SSO in a Java/JVM application via SAML, OAuth, JWT, and other authentication mechanisms is pac4j (https://github.com/pac4j/pac4j). It has integration to and demos for various web frameworks like Spring and Scala Play. It does a lot of the heavy lifting for integrating SSO into an application.
-
N
SAML: A fractal of bad design: https:// blog.trailofbits.com/2026/09/2 1/saml-a-fractal-of-bad-design/ Discussion: http:// news.ycombinator.com/item?id=4 9806335
-
OIDC is based on Oauth2. The auth part of Oauth stands for authorization, not authentication which brings me to the problem I have with OIDC - namely OIDC is about granting external party access to your data. You can mitigate this a bit via using something like Okta, which just does not have this data, but lets say you don't have Okta and all you…
-
The issue is not that SAML is XML per se, but rather: (1) auth happens over public internet rather than server-to-server, allowing the user to MITM the message flow and (2) the various XML parsing libs in various languages do not have consistent behavior when it comes to looking up a node by name (i.e. if there are dupes) or finding a child node…
- Sep 22
-
Didn’t JWT have a similar thing, where you could specify the algorithm to use and that included “null”?
-
“ Further, a committee of subcommittees having meetings is a recipe for “kitchen-sink” protocol design (e.g., waterfall methodology, big design up front, etc.).”- personally, I like having a kitchen sink
-
A fair criticism of the article is that it lists SAML's vulnerabilities but doesn't do the same comparison for OIDC. OIDC has its own problems too: JWT algorithm confusion, none algorithm attacks, missing audience checks, and bugs in JOSE libraries
-
SAML sucks, but it still has a bunch of features for its specific narrow enterprise SSO use-case that OIDC lacks - most notably IdP-initiated flow. OIDC is a constellation of specs with inconsistent support across products, whereas the commonly-implemented subset of SAML is more-or-less stable in its mediocrity.OIDC will eventually displace SAML…
-
H
SAML: A Fractal of Bad Design Link: https:// blog.trailofbits.com/2026/09/2 1/saml-a-fractal-of-bad-design/ Discussion: https:// news.ycombinator.com/item?id=4 9806335
-
I saw multiple implementations that looked for a signature, verified it, then just trusted the document as a whole rather than only the part that was signed. So as long as you had any signed SAML doc, you could provide an attention of your choosing and just bundle the signed one somewhere arbitrary inside of it.
-
My favourite SAML horror story, is that it used to be, that by default the main c implementation of xmlsig would not just check the sig with the public key specified but would also:- check it against an hmac using a password specified in the attacker controlled document.- check the signature using web pki (so the attacker could sign the saml…
-
May be I am in a minority here, but there are areas where SAML sort of shines1. For OIDC/OAuth2 the request has to originate from Service provider, most Enterprise IDP's rely on SAML for Single Sign on cause of its ability to do IDP initiated flows2. The security for SAML is baked into the payload itself, provides safety against MITM attacks, even…
-
It’s such a product of “Ooh! Markup languages! What can we use a markup language to solve!” When authentication is just not a document or data stream that needs marked-up.The article rightly connects this to XML, which was indeed the hammer to everything’s nail at the timeI think we aren’t done with this problem yet, though. OIDC makes a lot of…
-
SAML is even worse than the article describes, problems like needing to check what the signature actually signs. But I'm optimistic about the future, instead of relying on libraries that do a lot, such as general xml parsing, we can support a subset of SAML and only the dialects of the top ~10 providers. Extreme niche providers can be added ad-hoc…
-
H
SAML: A Fractal of Bad Design L: https:// blog.trailofbits.com/2026/09/2 1/saml-a-fractal-of-bad-design/ C: https:// news.ycombinator.com/item?id=4 9806335 posted on 2026.09.22 at 14:57:17 (c=0, p=4)