Having a security protocol that is so complex that it is practically impossible for a single person to understand all aspects of it sounds like a recipe for dis

Having a security protocol that is so complex that it is practically impossible for a single person to understand all aspects of it sounds like a recipe for disaster. Most XML-based standards from that era seems to suffer from the disease of wanting to capture every possible use case, with the result of being so general purpose and configurable that they end up being almost meaningless - in practice, implementations will only work for a very specific profile of the standard, and that is then what you need to implement, because implementing all of the standard is an insurmountable task. Because the standard is so general, it ends up becoming unusable as a reference for validating your implementation, and as a result, you end up using non-normative descriptions of the specific profile as a reference, or even worse, you validate your implementation against a random set of example documents that you have seen on the web. I think OIDC is better than SAML (it avoids the particular problem with malleable signatures described in TFA). You can actually read the standard to understand how the protocol works, whereas SAML is a jumble of abstract nonsense. I still think OIDC is a bit too complex, and I wonder if it really needs all those different profiles (hybrid flow, authorization code flow, implicit flow).