Why It's Time to Retire SAML — an Auth Protocol Built on XML Quicksand

A Trail of Bits engineer who spent years building SSO products on SAML argues the protocol has outlived its usefulness and should be deprecated in favor of OpenID Connect. SAML emerged from a 2002 OASIS committee that fused four competing XML security specs into one, then rode the SaaS and single sign-on boom of the late 2000s into a multibillion-dollar identity industry. Academia drove early adoption through projects like Yale’s CAS, Internet2’s Shibboleth, and simpleSAMLphp, and vendors including Ping, Okta, OneLogin, and Duo built their businesses on top of it. That committee-driven, kitchen-sink origin is precisely the problem: the protocol’s correctness rests entirely on reliable XML signature validation, which in practice almost always means wrapping libxmlsec, a dense and largely unaudited C library.

The deeper fault line is XML itself. Beyond its structural complexity relative to JSON — namespaces, schemas, DTDs, CDATA, and more — XML drags along a long roster of well-worn vulnerability classes such as XXE, billion-laughs entity expansion, DTD-driven SSRF, and various injection vectors, all of which a SAML library must neutralize before it even gets to authentication logic. On top of that sits canonicalization (C14N), the fragile process of normalizing messy XML into consistent bytes so signatures match. Canonicalization inconsistencies and parser differentials are the engine behind most modern SAML attacks, including Kelby Ludwig’s 2018 XML comment bypass and later Go standard-library round-trip bugs.

The standout weakness is XML signature wrapping (XSW), which lets an attacker restructure a signed document so the signature still validates while the parsed assertion says something else — effectively letting you “be whoever you want to be,” as the seminal 2012 paper put it. More than a decade after that research automated detection of the flaw, XSW variants keep surfacing in production, including recent work abusing libxml2 quirks to bypass SAML authentication. The author’s takeaway is that these recurring failures aren’t isolated bugs but symptoms of a design whose complexity is fundamentally at odds with security, and that its flaws double as a checklist of pitfalls to avoid when designing modern authentication protocols.