4 ms·
> I don't know why people say SAML is complex or hard This is a position only people with deep knowledge of SAML can take. Once you understand it, it’s not so
by haswell 2y ago
> I don't know why people say SAML is complex or hard
This is a position only people with deep knowledge of SAML can take. Once you understand it, it’s not so bad. But most people - including experienced engineers with decent knowledge of various authentication protocols - find SAML pretty impenetrable, and many of the people implementing it are doing so by following a series of documented procedures that they do not otherwise understand.
Source: was a PM for the authentication stack on a big enterprise platform and helped countless customers with their SAML confusion.
- nimish 2y agoAnything involving XmlDSig is far, far more complicated than it lets on. I doubt even the SAML experts know it 100%, maybe no one does.
- jf 2y agoThe main issue that I have with XmlDSig is that the signatures are stored inside of the document being signed. Because of that, you can’t properly implement the standard without writing enough of an XML parser to do the canonicalization needed to properly compute and verify the hashes used for signatures. In practice, this means you need approximately an entire XML stack just to hash some data, something that is a simple operation otherwise.