4 ms·

I don't doubt it was a mistake, but I'm curious what the alternative is here? I'm looking to add SAML to my to project in the medium-term.

tptacek 6y ago
SAML is the only mainstream user of XMLDSIG and 99%+ of the installed base of XMLDSIG. SAML libraries should include purpose-built, locked-down, SAML-only XMLDSIGs, and those XMLDSIGs should include purpose-built, stripped-down XMLs. The XML isn't even the hard problem here! XMLDSIG and XML Canonicalization are much more complicated than the baseline XML parser.
- neilv 6y ago
  Yep, I've implemented SAML multiple times with a purpose-built processing. And I implemented a non-SAML use of XML-DSIG standards, and discovered, when attempting to interoperate, that a major platform vendor's implementation of wasn't compliant, such that hashes would only be correct using that vendor's implementation (which I initially assumed was a mistake of mine, until an expert confirmed the major vendor was actually wrong).
- layer8 6y ago
  > SAML is the only mainstream user of XMLDSIG That’s not quite accurate. XMLDSIG is widely used in SOAP, and also in the European XAdES signature standard (which is an extension of XMLDSIG).
  - vbezhenar 6y ago
    Yep, in Kazakhstan almost every government web service uses XML signatures for interoperating. Of course nobody sees it outside of those systems, but it's everywhere inside. I have no idea about other countries, but I would not be surprised to find out that there are many other similar countries or organizations where that stuff works inside. You won't know about it until you touch it.
    - cesarb 6y ago
      Here in Brazil too, for instance the NF-e (electronic "nota fiscal", the English term seems to be "receipt", the documentation is at http://www.nfe.fazenda.gov.br http://www.nfe.fazenda.gov.br) and the recently released digital payment network (PIX, see https://www.bcb.gov.br/content/estabilidadefinanceira/cedsfn/Manual%20de%20Seguranca%20do%20PIX%20v3.1.pdf https://www.bcb.gov.br/content/estabilidadefinanceira/cedsfn... for the current release of the relevant manual) both use XMLDSig.
KajMagnus 6y ago
> I'm looking to add SAML to my to project in the medium-term Did you hear about SCIM, "System for Cross-domain Identity Management"? If combining with OIDC, then, seems to me one gets a more modern alternative to SAML. I've read just a bit about SCIM though. SCIM: https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning#what-is-system-for-cross-domain-identity-management-scim https://docs.microsoft.com/en-us/azure/active-directory/app-... I wrote more in this comment: https://news.ycombinator.com/item?id=25425665 https://news.ycombinator.com/item?id=25425665 (What's your project about?)
- tatersolid 6y ago
  If you want enterprise customers, you still need to support SAML in 2020.

tptacek 6y ago

SAML is the only mainstream user of XMLDSIG and 99%+ of the installed base of XMLDSIG. SAML libraries should include purpose-built, locked-down, SAML-only XMLDSIGs, and those XMLDSIGs should include purpose-built, stripped-down XMLs. The XML isn't even the hard problem here! XMLDSIG and XML Canonicalization are much more complicated than the baseline XML parser.

neilv 6y ago
Yep, I've implemented SAML multiple times with a purpose-built processing. And I implemented a non-SAML use of XML-DSIG standards, and discovered, when attempting to interoperate, that a major platform vendor's implementation of wasn't compliant, such that hashes would only be correct using that vendor's implementation (which I initially assumed was a mistake of mine, until an expert confirmed the major vendor was actually wrong).
layer8 6y ago
> SAML is the only mainstream user of XMLDSIG That’s not quite accurate. XMLDSIG is widely used in SOAP, and also in the European XAdES signature standard (which is an extension of XMLDSIG).
- vbezhenar 6y ago
  Yep, in Kazakhstan almost every government web service uses XML signatures for interoperating. Of course nobody sees it outside of those systems, but it's everywhere inside. I have no idea about other countries, but I would not be surprised to find out that there are many other similar countries or organizations where that stuff works inside. You won't know about it until you touch it.
  - cesarb 6y ago
    Here in Brazil too, for instance the NF-e (electronic "nota fiscal", the English term seems to be "receipt", the documentation is at http://www.nfe.fazenda.gov.br http://www.nfe.fazenda.gov.br) and the recently released digital payment network (PIX, see https://www.bcb.gov.br/content/estabilidadefinanceira/cedsfn/Manual%20de%20Seguranca%20do%20PIX%20v3.1.pdf https://www.bcb.gov.br/content/estabilidadefinanceira/cedsfn... for the current release of the relevant manual) both use XMLDSig.

KajMagnus 6y ago

> I'm looking to add SAML to my to project in the medium-term Did you hear about SCIM, "System for Cross-domain Identity Management"? If combining with OIDC, then, seems to me one gets a more modern alternative to SAML. I've read just a bit about SCIM though. SCIM: https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning#what-is-system-for-cross-domain-identity-management-scim https://docs.microsoft.com/en-us/azure/active-directory/app-... I wrote more in this comment: https://news.ycombinator.com/item?id=25425665 https://news.ycombinator.com/item?id=25425665 (What's your project about?)

tatersolid 6y ago
If you want enterprise customers, you still need to support SAML in 2020.