41–50 of 100 posts
Earlier quoted context omitted.
If your CISO wants to use SAML for anything, fire your CISO. Frankly I’d suggest the same thing about Okta but as bad as they are whatever you do to avoid them would probably be worse in practice.
I gather that you've fired every CISO you've ever had.
Everyone in here is saying SAML is dead and long live OIDC. The company I work for has SAML support, but not OIDC. As far as I understand it, all the customers are asking for SAML. I've never heard a request for SAML. This is in the health care sector.
Anyone who thinks OIDC is way easier than SAML has never implemented OIDC (or SAML).
Earlier quoted context omitted.
Lol, yeah, having SAML means putting XML parsing into critical security points. No thanks.
Even better: XML signatures, which are very easy to get wrong in both signing and verification.
Earlier quoted context omitted.
Lol, yeah, having SAML means putting XML parsing into critical security points. No thanks.
Is it that different from parsing JSON? A honest question, what's the difference? Billion laughs attacks and similar?
Earlier quoted context omitted.
Anyone who thinks OIDC is way easier than SAML has never implemented OIDC (or SAML).
I investigated both and implemented OIDC. It was difficult, but compared to the SAML and XML complexity, I'd say it was much easier.
Apples to apples, is it's not much different. XSD is just as complex as JSONSchema.
Verbose? Sure.
But people love XML so much, they invented JS-and-XML (JSX). :shrug:
This is a very weird page, as it seems to suggest that SAML is the only way to do single sign-on integration with IdPs like Okta. But modern systems all do OIDC, which is what you should do. You need a much better reason to support SAML than "the CISO wants it so they can use Okta", because the CISO can (and should) just use OIDC.
This is a very weird page, as it seems to suggest that SAML is the only way to do single sign-on integration with IdPs like Okta. But modern systems all do OIDC, which is what you should do. You need a much better reason to support SAML than "the CISO wants it so they can use Okta", because the CISO can (and should) just use OIDC.
Factually incorrect
This is a very weird page, as it seems to suggest that SAML is the only way to do single sign-on integration with IdPs like Okta. But modern systems all do OIDC, which is what you should do. You need a much better reason to support SAML than "the CISO wants it so they can use Okta", because the CISO can (and should) just use OIDC.
OIDC is better when using the authorization code flow because it does not only rely on cryptography while validating the token. The relying party needs to talk to the IdP. This is better from a security perspective, because past vulnerabilities have shown, that implementing the cryptography right in every relying party is challenging. You can achieve similar security with SAML when using the artifact binding. Note: I…
Earlier quoted context omitted.
OIDC is better when using the authorization code flow because it does not only rely on cryptography while validating the token. The relying party needs to talk to the IdP. This is better from a security perspective, because past vulnerabilities have shown, that implementing the cryptography right in every relying party is challenging. You can achieve similar security with SAML when using the artifact binding. Note: I…
I don't think artifact binding really addresses many of the issues people are talking about when they suggest OIDC is categorically more secure than SAML.