> SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps. Agree that SAML is godawful (to put it lightly) and also v

> SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps. Agree that SAML is godawful (to put it lightly) and also very curious about your from-scratch implementation. I assume that by "crazy deps" you're referring to xmlsec1 (which, disturbingly, nearly every non Java/.NET library uses) Did you implement XML-DSig yourself? (!) I'd be very interested in comparing notes on test cases. I wrote a SAML testing tool [1][2] inspired by the "On Breaking SAML" paper [3] but the tool is incomplete and essentially abandoned because I hoped that people would stop implementing SAML. Would you be open to comparing notes on test suites for SAML implementations? Footnotes: 1: http://saml.oktadev.com/ http://saml.oktadev.com/ 2: https://bitbucket.org/jfranusic/saml-messenger https://bitbucket.org/jfranusic/saml-messenger 3: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final91-8-23-12.pdf https://www.usenix.org/system/files/conference/usenixsecurit...