51–60 of 100 posts
Earlier quoted context omitted.
Lol, yeah, having SAML means putting XML parsing into critical security points. No thanks.
Is it that different from parsing JSON? A honest question, what's the difference? Billion laughs attacks and similar?
A computer programmer wouldn't even know where to begin, as the chesterton's fence had long been rejustified
Earlier quoted context omitted.
I don't think artifact binding really addresses many of the issues people are talking about when they suggest OIDC is categorically more secure than SAML.
OIDC is newer and many of the issues with SAML were addressed in the architecture. However I’m curious to hear which attack vectors you are thinking about.
This is a very weird page, as it seems to suggest that SAML is the only way to do single sign-on integration with IdPs like Okta. But modern systems all do OIDC, which is what you should do. You need a much better reason to support SAML than "the CISO wants it so they can use Okta", because the CISO can (and should) just use OIDC.
If your CISO wants to use SAML for anything, fire your CISO. Frankly I’d suggest the same thing about Okta but as bad as they are whatever you do to avoid them would probably be worse in practice.
Earlier quoted context omitted.
I investigated both and implemented OIDC. It was difficult, but compared to the SAML and XML complexity, I'd say it was much easier.
XML is marginally more complicated than JSON: attributes and namespaces. Apples to apples, is it's not much different. XSD is just as complex as JSONSchema. Verbose? Sure. But people love XML so much, they invented JS-and-XML (JSX). :shrug:
Earlier quoted context omitted.
OIDC is newer and many of the issues with SAML were addressed in the architecture. However I’m curious to hear which attack vectors you are thinking about.
Most obviously, the precarity of XMLDSIG.
Browser sends artifact to RP, RP fetches assertion from IdP via HTTPs, afterwards verifies the signature.
Signature verification is not implemented correctly? The attacker still needs to break HTTPS…. And then you would have a big problem anyway.
> As well in "HTTP Redirect Binding" or "HTTP POST Binding", The RelayState value MUST NOT exceed 80 bytes
From https://docs.oasis-open.org/security/saml/v2.0/saml-bindings...
At FusionAuth, we have an open issue for this: https://github.com/FusionAuth/fusionauth-issues/issues/2467 which you can read for more details.
SAML is full of these kinds of gotchas. We have an open source library which provides Java SAML bindings: https://github.com/FusionAuth/fusionauth-samlv2
Earlier quoted context omitted.
I investigated both and implemented OIDC. It was difficult, but compared to the SAML and XML complexity, I'd say it was much easier.
XML is marginally more complicated than JSON: attributes and namespaces. Apples to apples, is it's not much different. XSD is just as complex as JSONSchema. Verbose? Sure. But people love XML so much, they invented JS-and-XML (JSX). :shrug:
This is a very weird page, as it seems to suggest that SAML is the only way to do single sign-on integration with IdPs like Okta. But modern systems all do OIDC, which is what you should do. You need a much better reason to support SAML than "the CISO wants it so they can use Okta", because the CISO can (and should) just use OIDC.
OIDC doesn't scale, and OIDC Federation is still in draft. SAML Federation is mature with wide support and good discovery UX thanks to SeamlessAccess.
SAML has a variety of standard attribute bundles, entity categories, frameworks, and profiles covering important integrations, e.g., identity assurance. These are slowly being defined in (or ported to) OIDC.
I like OIDC and think highly of the people working on it, but it's nowhere near as cut and dry as you suggest.
Everyone in here is saying SAML is dead and long live OIDC. The company I work for has SAML support, but not OIDC. As far as I understand it, all the customers are asking for SAML. I've never heard a request for SAML. This is in the health care sector.
Anyone who thinks OIDC is way easier than SAML has never implemented OIDC (or SAML).
I tried that with SAML (back then, it didn't require kludgy X.509 thumbprint management in AWS), and I ran away crying after a couple of days trying to understand why it fails.