The Security Assertion Markup Language (SAML) has been a cornerstone of enterprise authentication and single sign-on (SSO) infrastructure since its creation in 2002, but security researchers argue it is time for the protocol to be deprecated in favor of modern alternatives.
SAML emerged from a merger of four different XML-based security protocols—S2ML, AuthXML, X-TASS, and ITML—created by the OASIS Security Services Technical Committee. According to a post on Trail of Bits, this design-by-committee approach resulted in unnecessary complexity. The protocol was born out of academic need in the early 2000s, when universities and emerging web services required standardized authentication mechanisms. Academic institutions like Yale and Internet2 drove early adoption, eventually making way for the commercial SSO industry boom of the late aughts, with companies like Okta and OneLogin building billion-dollar businesses on top of SAML.
However, SAML’s reliance on XML has proven problematic. XML introduces numerous security vulnerabilities including XXE (XML External Entity) attacks, entity expansion attacks, XPath injection, and others—before even addressing SAML-specific flaws. The protocol’s complexity stands in stark contrast to simpler alternatives like JSON-based OpenID Connect (OIDC).
A critical vulnerability class involves XML signature wrapping (XSW) attacks, which exploit weaknesses in how SAML implementations validate XML signatures. A landmark 2012 paper titled “On Breaking SAML: Be Whoever You Want to Be” demonstrated how attackers could impersonate any user by manipulating XML signatures. Despite this research being over a decade old, XSW vulnerabilities persist in fielded implementations today.
Canonical representation of XML data presents another systemic problem. When a SAML service provider and identity provider cannot agree on a consistent XML representation, cryptographic signatures fail to validate. Canonicalization bugs have enabled attacks like the XML comment bypass discovered in 2018, along with parser differential and round-trip vulnerabilities in implementations using libraries like libxml2 and Go’s standard library.
According to the analysis, SAML’s foundational weaknesses stem from its XML underpinning and the complexity required to implement it securely. Most implementations rely on libxmlsec, a complex C library that few developers thoroughly understand. The researchers recommend deprecating SAML in favor of modern protocols designed with contemporary security principles and simpler data formats.
Key facts
- SAML was created in 2002 by merging four separate XML-based security protocols from different vendors
- XML signature wrapping attacks, identified in research dating back to 2005-2012, remain present in SAML implementations today
- The protocol was originally designed to address authentication needs for emerging web services in academic and corporate environments
- Modern alternatives like OpenID Connect (OIDC) use simpler JSON-based formats rather than XML
- Most SAML implementations rely on libxmlsec, a complex C codebase that introduces security risks