3 ms·

Agree. SAML is crazy complicated.

by nickbauman 11y ago

notwhereyouare 11y ago
Yep. Spent basically 2 months trying to implement saml manually. We had kinda a working implementation for something else. Tried to use it. Didn't work. Ended up finding a solution that somebody published. Modified and got working for my situation. It sucked and put me really behind schedule. Doesn't matter. The other members of the project were ever further behind
volkadav 11y ago
The entire spec, yes, is big, but the part you actually need is not that complicated. I implemented the IdP for the new york times (there's quite a bit of third party shit plugged into the nytimes.com web experience that we wanted to be transparent to users) in a few weeks as I recall, and I'm not some coding super-genius. (It was kinda hacktified and minimalistic, but it worked at scale. ¯\_(ツ)_/¯) Most of our counter-parties were up and running in a week or so. Compared to the abysmal quagmire that was our ecommerce code, SAML implementation was a total milk run.
X-Istence 11y ago
The worst part is that SAML doesn't seem to be adequately documented, and figuring out how to do various flows against it (such as allowing a user to auth into a web app, and a third party API such as OpenStack) is almost impossible to figure out.
jordache 11y ago
why would you need to understand the entire SAML spec? Are you implementing a custom idp system? Assuming you are using a well established authentication provider that has built in support for SAML? In that case it's simply a matter of configuration....
SCHiM 11y ago
Not only is it complicated, the lack of documentation and the leaky XML libraries that abound ensure that whoever ends up implementing SAML are prone to make security mistakes. I've audited two systems that used SAML to authenticate their users, both times I found XXE vulnerabilities that let me read files from their servers with the permissions of the webserver process.

3 ms·

Agree. SAML is crazy complicated.

by nickbauman 11y ago

Agree. SAML is crazy complicated.

notwhereyouare 11y ago
Yep. Spent basically 2 months trying to implement saml manually. We had kinda a working implementation for something else. Tried to use it. Didn't work. Ended up finding a solution that somebody published. Modified and got working for my situation. It sucked and put me really behind schedule. Doesn't matter. The other members of the project were ever further behind
volkadav 11y ago
The entire spec, yes, is big, but the part you actually need is not that complicated. I implemented the IdP for the new york times (there's quite a bit of third party shit plugged into the nytimes.com web experience that we wanted to be transparent to users) in a few weeks as I recall, and I'm not some coding super-genius. (It was kinda hacktified and minimalistic, but it worked at scale. ¯\_(ツ)_/¯) Most of our counter-parties were up and running in a week or so. Compared to the abysmal quagmire that was our ecommerce code, SAML implementation was a total milk run.
X-Istence 11y ago
The worst part is that SAML doesn't seem to be adequately documented, and figuring out how to do various flows against it (such as allowing a user to auth into a web app, and a third party API such as OpenStack) is almost impossible to figure out.
jordache 11y ago
why would you need to understand the entire SAML spec? Are you implementing a custom idp system? Assuming you are using a well established authentication provider that has built in support for SAML? In that case it's simply a matter of configuration....
SCHiM 11y ago
Not only is it complicated, the lack of documentation and the leaky XML libraries that abound ensure that whoever ends up implementing SAML are prone to make security mistakes. I've audited two systems that used SAML to authenticate their users, both times I found XXE vulnerabilities that let me read files from their servers with the permissions of the webserver process.