Trail of Bits traces SAML's insecurity to the XML signature layer underlying most fielded implementations

Thomas Ptacek put the dependency in one sentence in 2023, and the post quotes him: "What's insidious about SAML is that it really is mostly straightforward to understand, but it's built on a foundation of sand, bone dust, and ash; it works ... if you assume XML signature validation is reliable. But XML signature validation is deeply cursed, and is so complicated that most fielded SAML implementations are wrapping libxmlsec, a gnarly C codebase nobody reads." ^[4]

The claim is narrow, and it is testable: the assertion flow is the comprehensible part, and the cryptographic check underneath it is not. In deployed systems that check is usually a C library the identity vendor did not write. Trail of Bits says SAML is "being crushed under the weight of its own complexity" and should be replaced with OpenID Connect. ^[11][1]

The people who would have to act on that built their products on the protocol. Ping Identity was founded in 2002, OneLogin and Okta in 2009, Duo Security in 2010; all but Duo were essentially built on SAML, and Duo shipped its first SSO product in 2015. ^[8] The academic and enterprise stack came earlier: CAS at Yale in 2002, Shibboleth IdP from Internet2 in 2003, Microsoft's ADFS in 2003, simpleSAMLphp from Uninett around 2007, all of which eventually supported SAML. ^[9] The post's author says he worked on Duo's first on-premises Access Gateway, which was built on simpleSAMLphp and SAML. ^[10]

The design record starts with a merge. SAML was created in 2002 by the OASIS Security Services Technical Committee, which took in four separate XML security specifications: S2ML from Netegrity, AuthXML from Securant, X-TASS from VeriSign, and ITML from Jamcracker. ^[2][3]

The attack class is XML signature wrapping, which the post calls the arrow to SAML's heel, with earlier signature wrapping research in 2005, 2008 and 2009 and SAML-specific work in 2008. ^[5] "On Breaking SAML: Be Whoever You Want to Be" landed in 2012, ten years after the specification ^[12] and seven years after the earliest signature wrapping paper the post cites. ^[13] Kelby Ludwig's XML comment bypass came later, at the implementation layer rather than the design layer. ^[7]

The supplied text does not cite a CVE or report active exploitation; the case is the design origin and the research lineage, and it ends with a recommendation to move on. ^[14] An identity owner can defend a scheduled migration on that. There is nothing here that justifies an emergency change window, and whether the migration can start at all depends on which SaaS vendors in the estate accept an OIDC client registration today.