How is Shibboleth SP's track record on SAML vulnerabilities, either patching them quickly or avoiding them altogether? My company needed to implement SAML SP s

How is Shibboleth SP's track record on SAML vulnerabilities, either patching them quickly or avoiding them altogether? My company needed to implement SAML SP support in one of our products so we could get academic customers, particularly those that are part of the InCommon federation. We contracted with a company that specializes in SAML and Shibboleth to help us get it right. We decided to use Shibboleth SP running in a container; that container also has Apache httpd (as practically required by Shib SP) and a little Python shim app that generates a JWT and passes it back to our main app. Hopefully that's a good way of using the nearest thing to a canonical SAML SP implementation, without running our whole application through Apache httpd. In case anyone's interested, our Shib SP container setup, with the Python shim app, is here: https://github.com/PneumaSolutions/shib-sp https://github.com/PneumaSolutions/shib-sp It's probably still too specific to our application, but might be useful as a starting point for others.