Why We Should Kill Saml2
summary
Clear claim: SAML2 routinely fails the practical needs of web SSO — brittle metadata discovery, opaque redirect encoding, fragile XML signature semantics, and brittle logout choreography — while OpenID Connect fixes each with required discovery, simple query parameters, JWT signing, scoped attributes, and back‑channel logout. Reproducible tooling includes an open‑source SAML library and a Chrome SAML dev tool that expose signature wrapping and duplicate-id attacks, and these libraries power millions of users and demonstrate a SignedXml bug patched 2016; the built test IdP reproduces failures reliably.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:22History
- 2:15Single Sign On
- 5:27Metadata
- 9:11Redirect
- 11:35Demo
- 13:24Entity ID
- 16:40Keys
- 19:20Response
- 21:35Bindings
- 23:32Trusting
- 24:49Saml2 Breaking
- 25:53Sample to Flow
- 27:25Duplicate Reference IDs
- 31:13How do we know the key
- 32:14Signatures
- 33:20Delegation
- 34:03XML Signature
- 34:43Logout Request
- 36:01Final Scenario
- 38:03Discovery Service
- 40:26Common Login Server
- 41:10Connect Federation
- 41:33Summary
- 43:52Outro
related talks
31mIdentity Theft: Attacks on SSO Systems
47mho Are You? Delegation, Federation, Assertions and Claims
44mPresentation on Security Standards and Protocols
46mSecure SSO Authentication: Strategies to Eliminate Vulnerabilities
01h 12mIdentity 2.0: the what, why and how of social and federated login
21mVetting Single Sign-On SDK Implementations via Symbolic Reasoning
22mSSO Wars: The Token Menace
40mModern Single Sign-On: On the Security of Single Sign-On ...