Design flaws in SAML causing enterprise identity management pain points
Problem
SAML's complex standard and buggy implementations cause security vulnerabilities and incorrect signature validation, while the lack of a provider‑agnostic authentication model forces enterprises to build custom solutions for each service, increasing risk and cost.
Pain points
- Default XMLSig implementation performs extra validation using an attacker‑controlled password
- Web PKI allows attackers to sign SAML documents with their own TLS key, making the signature appear valid
- No provider‑agnostic authentication method, requiring custom implementations per service
- OIDC has inconsistent support and lacks IdP‑initiated flow
- SAML requires checking what the signature actually signs
Questions to verify
- Do you use SAML in an enterprise environment?
- Have you encountered any of the mentioned security vulnerabilities or signature validation errors?
- Would you benefit from a provider‑agnostic authentication solution?
Evidence
quote · @Anonymous
My favourite SAML horror story, is that it used to be, that by default the main c implementation of xmlsig would not just check the sig with the public key specified but would also:- check it against an hmac using a password specified in the attacker controlled document.- check the signature using web pki (so the attacker could sign the saml document with their TLS key for their own personal domain and it would always be considered valid)I honestly dont know how sites with saml arent getting hacked all the time. The only thing worse than the absolute terrible standards are the absolute terrible implementations.
quote · @Anonymous
It’s such a product of “Ooh! Markup languages! What can we use a markup language to solve!” When authentication is just not a document or data stream that needs marked-up.The article rightly connects this to XML, which was indeed the hammer to everything’s nail at the timeI think we aren’t done with this problem yet, though. OIDC makes a lot of assumptions in service to Google and others. And tailscale as mentioned, despite “holding the line,” already reveals the cracks when things like GitHub accounts have to be treated differently from others.What we are missing is a provider-independent way to do this. I should be able to create an account and log in just about anywhere using a backend I control. It can be done, but not with what we have today
quote · @Anonymous
SAML sucks, but it still has a bunch of features for its specific narrow enterprise SSO use-case that OIDC lacks - most notably IdP-initiated flow. OIDC is a constellation of specs with inconsistent support across products, whereas the commonly-implemented subset of SAML is more-or-less stable in its mediocrity.
Disclaimer: this card is distilled by AI from community discussions as “pain point evidence”. It is a starting point for need analysis and validation, not a “validated market need”. AI has analytical limits; please open the original discussion above to manually verify before key decisions.