SAML: A Fractal of Bad Design

Security Assertion Markup Language (SAML) was created in 2002 by OASIS SSTC, merging four XML-based security protocols and relying on complex XML signature validation. It became the backbone of early single sign-on solutions for academia and later for commercial identity providers such as Ping, Okta, and Duo. The protocol’s intricate design and fragile XML foundation have led to widespread security research criticism and a push toward modern alternatives like OpenID Connect.