4 ms·
Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP https://github.com/nic
by ak217 9y ago
Thanks for the thorough response. I haven't heard of TinySAML before, are we talking about https://github.com/nicolas-raoul/Tiny-SAML-IDP https://github.com/nicolas-raoul/Tiny-SAML-IDP? In general, my experience with SAML in the wild is congruent to yours with OIDC: it's a meandering tree of crappy options that doesn't fit in my head. I'm discouraged to hear the same opinion about OIDC. Do you really think SAML has a bigger future than OIDC?
Are there implementation notes or library implementations of SAML and OIDC that you would recommend as good references? I'm aware of Okta's docs, https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet, https://wiki.mozilla.org/Security/Guidelines/OpenID_Connect https://wiki.mozilla.org/Security/Guidelines/OpenID_Connect, and the Google docs you linked, but would like to learn more/find better libraries.
- tptacek 9y agoI hope both SAML and OIDC go away.
- lvh 9y agoSorry for the term confusion: TinySAML is what I’m informally calling the tiny subset of SAML we’re choosing to care about. Neither full-SAML nor full-OIDC fit in my head; I’ll also concede that full-SAML is much more complicated than full-OIDC, but that doesn’t matter: narrowing scope is much more effective for SAML than OIDC. I hope both protocols become obsolete. SAML may not be the future, but it’s definitely the present. I’m not convinced OIDC is materially better. ‘tptacek will have much more informed opinions about relative SAML library quality so I’ll leave that to him.