SAML: A Fractal of Bad Design

The Security Assertion Markup Language (SAML) is an XML-based authentication protocol that was created in 2002 by the Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee (SSTC). It was designed to provide a way for users to authenticate to multiple web services. However, SAML has become plagued by complexity and security vulnerabilities, making it an outdated and unreliable protocol.

SAML's design was influenced by a committee of subcommittees, which resulted in a "kitchen-sink" protocol design. This is a common issue with protocols that are created by a group of people who have different opinions and ideas, leading to a bloated and complex system. The creation of SAML was necessary as the internet shifted from Web 1.0 to Web 2.0, and it was driven by both academia and commercial industries. However, academia was the biggest driver of this movement.

In 2002, Central Authentication Service (CAS) was created at Yale, Shibboleth IdP in 2003 by Internet2, ADFS in 2003 by Microsoft, simpleSAMLphp around 2007 by Uninett, a state-owned Norwegian company with close ties to academia. These authentication projects eventually supported SAML in some way or another.

The SAML protocol's foundation is built on XML, which is a complex and difficult language to work with. XML has vulnerabilities such as XML signature wrapping (XSW), XXE, entity expansion, DTD retrieval, XPath/XQuery/XInclude/XSLT/CDATA injection, and more. SAML libraries need to handle all these vulnerabilities before even getting to the actual SAML functionality.

The complexity of XML makes it difficult to secure SAML implementations. Compared to newer alternatives like JSON, XML is more verbose and difficult to work with. This complexity can lead to security issues and make it difficult for developers to maintain and update SAML implementations.

Despite its flaws, SAML was able to provide a foundation for the SSO, identity, and authentication provider industry. Companies such as Ping Identity, OneLogin, Okta, and Duo Security were built on the SAML protocol. This was the case until 2012 when a paper by Kelby Ludwig called "On Breaking SAML: Be Whoever You Want to Be" was published, which tested theory against practice and resulted in an automated way to check for XSW attacks.

However, XSW is still present today, highlighting the flaws in SAML's design. XML has a lack of security track record, and it's not surprising that SAML has become a "fractal of bad design". The complexity of XML, combined with the plethora of security vulnerabilities, has made SAML a difficult protocol to maintain and secure. It's time for SAML to retire and for organizations to move on to modern alternatives like OpenID Connect (OIDC).