3 ms·
One advantage of SAML over OIDC - they standardized IDP initiated login, so you can skip the "login using..." button when sending an already logged in user to a
by unilynx 2y ago
One advantage of SAML over OIDC - they standardized IDP initiated login, so you can skip the "login using..." button when sending an already logged in user to a third party system.
But the various XML canonicalization specs, XML transforms, embedding X509 certificates, all the mess they created to be able to embed signatures inside XML messages instead of just sending them separate from the assertions, is horrible to get right and will be a source of more security bugs for many, many years to come. https://www.google.com/search?q=canonicalization+CVE+SAML https://www.google.com/search?q=canonicalization+CVE+SAML
- deathanatos 2y ago> One advantage of SAML over OIDC - they standardized IDP initiated login, so you can skip the "login using..." button when sending an already logged in user to a third party system. OIDC supports this, though it is an optional part of the standard. This is the initiate_login_uri metadata on a relying party. https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin https://openid.net/specs/openid-connect-core-1_0.html#ThirdP...
- OliverJones 2y agoFWIW, the XML signature stuff in dot net just works. Once you get dot net's XML stuff itself working.
- jcmfernandes 2y agoOIDC standardadized Initiating Login from a Third Party: https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin https://openid.net/specs/openid-connect-core-1_0.html#ThirdP... It works very differently, but it will get the job done in a much safer way.