8 ms·
A Gentle Introduction to SAML
- denysvitali 2y agoI still can't find a convincing reason to use SAML over OIDC. To me the SAML vs OIDC difference looks (also for the exchange format) pretty similar to the situations where XML vs JSON is used. That is, I've always seen SAML as being very old / enterprise, and OIDC being the breath of fresh air that is JSON compared to XML. I'd love to be proven wrong and start seeing SAML under a different lens as I don't currently see any benefit in starting a new project thst supports SAML
- noleary 2y agoJust speaking practically, the biggest reason to support SAML is that customers use it. Tons of companies still use old school Active Directory for SAML -- and aren't even quite ready to migrate to Entra (formerly Azure Active Directory).
- denysvitali 2y agoThis only supports my point of considering SAML as being "ancient" - but I just don't know if it's true. It's just a feeling seeing it mostly in banks and other old-school enterprises (AD plays a huge role here as you mentioned)
- scott_w 2y agoNot even close. Pretty much every enterprise uses it because, from an admin point of view, it does everything the customer wants. Centralised user management is pretty much mandatory for different compliance and AD and Okta meet those needs just fine. Hell, from a user perspective, I don’t even hate the Okta SAML implementation now we have support for Yubikey enabled. Click a button, I’m in.
- mooreds 2y ago> Just speaking practically, the biggest reason to support SAML is that customers use it. This is a huge reason to support SAML, I agree. You can talk all day long about how OIDC is better, but if a customer or application only supports SAML, that's what needs to be implemented. Especially since single sign-on is usually an enabler, not the whole value proposition of any application.
- muhehe 2y agoI certainly won't defend saml (it does suck), but saying oidc is a breath of a fresh air seems like an overstatement :).
- barryrandall 2y agoMultilateral federation is SAML's killer app, and why higher education still uses it instead of OIDC.
- adeinega 2y agoI hope there will be some changes on that soon, have a look at https://openid.net/specs/openid-federation-1_0.html https://openid.net/specs/openid-federation-1_0.html.
- high_5 2y agoHa, just found out you already posted the spec. Still, even if it gets published, IMO multilateral federations will migrate veeeery sloooooowly.
- adeinega 2y agoThe beauty of this spec is that it defines a set of basic components to build multilateral federations between various types of entities (without a need to rely on Web PKI + of course, the types of these entities are limited by the imagination only). Regardless of what's going to happen and what isn't going to happen to existing SAML multilateral federations, I think this this specification might begin to be adopted for various other use cases. It's worth mentioning, the spec was also written by people who aren't new to anything from that, they were already deeply involved in SAML multilateral federations.
- EvanAnderson 2y agoA minor mistake: You say "An identity provider (ISP): the centralized service your user will use to authenticate". You mean "IDP", not "ISP". (That happens to me w/ using uncommon initialisms that are one letter off from the ones I use more commonly. My muscle memory inevitably makes me type some fraction of the more common one even when I mean otherwise.)
- noleary 2y agoThanks, Evan! Fixed
- gstrike 2y ago[dead]
- coronapl 2y agoI'm glad this company is building an open-source and straightforward solution for SAML integration. I struggled to find the right solution for my product and tried multiple libraries and services, including AWS Cognito. Diving deep into OAuth and OIDC was crucial. Lesson learned: stick to the basics.
- noleary 2y agoGlad the project seems useful to you :) Any chance you'd share what went wrong with the other libraries/services? Curious to hear what mistakes we should avoid.
- coronapl 2y agoSure! I think Cognito is a decent solution. However, client-app integration can be tricky, and the documentation is quite ambiguous in my opinion. The recommended implementation option is Amplify, but I had concerns because it doesn't support HTTP-only cookies. I also experimented with NextAuth.js, but its documentation wasn't great, possibly because they're working on a new major version. I struggled particularly with supporting multi-tenancy with Microsoft AD. I noticed that you offer SAML over OAuth. I'm curious to try that out.
- noleary 2y agoYeah, we made SAML over OAuth available mainly for ease of use in NextJS. Drop me a note (email in HN bio)if you end up trying us out. Would love to see whether we're on the right track.
- DemocracyFTW2 2y agoI have no idea what I'm talking about but the comments in this thread have fully convinced me that this is a preferable state of affairs
- jf 2y agoYou are 100% correct... SAML is one case where ignorance truly is bliss.
- adeinega 2y ago"SAML isn't a recipient for innovations" or something along this line was once said by Vittorio Bertocci... it's hard to add much to it. OpenID Connect is a core for many new specs in the space, "OpenID for Verifiable Presentations" and "OpenID for Verifiable Credentials" just to name a few. Any new company choosing one vs another, I suggest to take into account this aspect.
- mooreds 2y ago100%. See also my comment here about the committee improving it shutting down: https://news.ycombinator.com/item?id=41056529 https://news.ycombinator.com/item?id=41056529
- Biganon 2y agoIn an app that's accessed through HTTPS only, is it enough to ensure the Assertions are signed? I'm using the "WantAssertionsSigned" policy only and I'm wondering if it's secure or not
- ucarion 2y agoIt's hard to answer questions like this in the abstract. The details matter.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- chairmansteve 2y agoAnyone got a gentle introduction to OIDC?
- mooreds 2y agoA bit of self-promotion: this article I co-wrote covers both OAuth and OIDC: https://fusionauth.io/articles/oauth/modern-guide-to-oauth https://fusionauth.io/articles/oauth/modern-guide-to-oauth I particularly like the idea of "modes" which discusses different ways of thinking about authentication and authorization based on who holds user data. HN discussion here: https://news.ycombinator.com/item?id=29752918 https://news.ycombinator.com/item?id=29752918 Edit: updated link to HN discussion
- hardwaresofton 2y agoIf you want to understand and implement one of these in a day, check out CAS: https://jasigcas.readthedocs.io/en/latest/cas-server-documentation/protocol/CAS-Protocol-Specification.html https://jasigcas.readthedocs.io/en/latest/cas-server-documen... Unfortunately it’s hard to get JUST the 1.0 spec anymore And 2/3 weren’t really my cup of tea… but it’s still simpler and the basics (of honestly all these systems) is the same
- mooreds 2y agoIf you are interested in a conceptual guide to SAML, rather than a walk through which shows XML, this is still the best one I know of: https://duo.com/blog/the-beer-drinkers-guide-to-saml https://duo.com/blog/the-beer-drinkers-guide-to-saml Saw some simplifications in the post like where the signature goes (it can go in the assertion but also can go in the response) but appreciate this is a gentle intro, as the author states: > I’ve omitted a lot of details here, some of which matter greatly for security reasons. One thing about SAML is that, like HTML, the world is the best test case, and you can run into compatibility issues over and over (hyrums law and all that). My employer, FusionAuth, also supports SAML and has for years (first commit to our open source SAML bindings was in 2019) and there are still edge cases we run into.
- mkpp 2y ago[dead]
- ajhenrydev 2y agoHaving worked with implementing SAML for a large University-funded application, I learned more than I ever wanted to know but less than I needed to know
- philjohn 2y agoAh yes, the dreaded University integration! I was in charge of a SaaS offering for Academic and Public libraries years ago, and we had to add SAML functionality for the Academic side ... it was a frustrating few weeks, and I was glad when it was over.
- rkeene2 2y agoI see this comment often, but when I implemented SAML, the spec wasn't too unreadable... I did write my own IdP [0] instead of using something that existed though, since those were more complicated than I needed. So maybe because I only implemented features I was using it wasn't bad. What did you struggle with? [0] https://github.com/rkeene/saml-idp/blob/master/lib/saml/saml.tcl https://github.com/rkeene/saml-idp/blob/master/lib/saml/saml...
- recursive 2y agoWhen I tried to do this, I was looking at an OASIS spec I think? Several hundred pages? I found it to be quite impenetrable. Mainly because of all the jargon. It was all defined of course, but just in terms of other jargon. It was a bit like trying to understand monads by reading wikipedia. In the end I spent about a month on the project, with basically nothing to show for it. If GPT had existed at the time, I probably could have gotten enough of a foothold using AI conversations to understand the spec.
- jf 2y agoI regret learning nearly everything that I know about SAML.
- cyberpunk 2y agoThis is exactly how it works every time I need to touch SAML. Spend two weeks with the ping identity manual, somehow get everything working, forget all about it until the next time a customer wants it :}
- fitzgera1d 2y agothank you for this
- ataylor284_ 2y agoWhen I had to figure out how to add SAML authentication to a custom application, I built a barebones, no-framework Java application[1] just to understand the webflow. A good way to understand it is to just set up your own IDP like Keycloak running locally and play around with it. [1]: https://github.com/ataylor284/saml-example https://github.com/ataylor284/saml-example
- mdavidn 2y agoIf given the option, go with OpenID Connect instead. Both the OIDC and SAML standards are overly complex and designed to accommodate more use cases and enterprise configurations than they should. That said, OIDC is based on OAuth 2 and does not depend on XMLDSig. That's a win, in my book. OIDC library support is good, and getting basic federated login working for common patterns is relatively easy.
- ataylor284_ 2y agoI second this. OIDC is much nicer and my experience using it with federated identity sources through AWS Cognito was smooth. The sad reality is that SAML is already entrenched in many enterprise environments and unavoidable.
- christkv 2y agoWe have customers using SAML and ours a pain. At least one or two issues a year.
- adeinega 2y agoI second this.
- mooreds 2y agoAre they config time issues or runtime? That is to say, do the issues occur when you are integrating a new customer, or are they with current customers where something changes or pops up and there's an issue?
- christkv 2y agoThe most common problem is they forget to upgrade their yearly certificates or mess up the deployment. Other times they don’t have their servers correctly configured to read our manifest and thus miss certificate updates from our side. Or they mess up the payload configuration so we don’t receive the principal.
- ucarion 2y ago
- zerkten 2y agoHaving dealt with the operational side of SAML implementations, as well as implementation of the spec, it would be nice if tools like this generated docs for customer setup that are app specific. This would go from initial setup to certificate updates to configuring custom attributes supported by the SP.
- unilynx 2y agoOne advantage of SAML over OIDC - they standardized IDP initiated login, so you can skip the "login using..." button when sending an already logged in user to a third party system. But the various XML canonicalization specs, XML transforms, embedding X509 certificates, all the mess they created to be able to embed signatures inside XML messages instead of just sending them separate from the assertions, is horrible to get right and will be a source of more security bugs for many, many years to come. https://www.google.com/search?q=canonicalization+CVE+SAML https://www.google.com/search?q=canonicalization+CVE+SAML
- deathanatos 2y ago> One advantage of SAML over OIDC - they standardized IDP initiated login, so you can skip the "login using..." button when sending an already logged in user to a third party system. OIDC supports this, though it is an optional part of the standard. This is the initiate_login_uri metadata on a relying party. https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin https://openid.net/specs/openid-connect-core-1_0.html#ThirdP...
- OliverJones 2y agoFWIW, the XML signature stuff in dot net just works. Once you get dot net's XML stuff itself working.
- jcmfernandes 2y agoOIDC standardadized Initiating Login from a Third Party: https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin https://openid.net/specs/openid-connect-core-1_0.html#ThirdP... It works very differently, but it will get the job done in a much safer way.