SAML: A fractal of bad design
Points and comments are a snapshot, not live.
SAML is an overly complex, flawed protocol that should be retired in favor of OIDC.
The author argues that SAML, built on XML, suffers from fatal flaws including complexity, canonicalization issues, enveloped signatures, kitchen-sink design, and ossification. XML signature wrapping (XSW) attacks and parser differentials continue to plague implementations. The protocol was designed by committee for a pre-HTTP-dominant era and has not adapted to modern mobile, SPA, or IoT environments. OpenID Connect (OIDC) is presented as the superior alternative, offering simpler design, HTTP-native assumptions, and organic growth through iterative RFCs. The only remaining SAML advantage-networks where IdP and SP cannot communicate directly-is addressed by OIDC's implicit flow with form post. The author recommends service providers adopt OIDC and abandon SAML.
What commenters are saying
Commenters split into two camps: those arguing SAML is a necessary evil for enterprise compatibility, and those agreeing it should be deprecated. Many enterprise users assert that SAML support is a non-negotiable requirement for SaaS products, with one noting "if you don't have SAML support, I can find a product that does." Others counter that this mindset enables security theater and that vendors should push for better standards. Several commenters note that most modern IdPs (including Entra and Okta) support OIDC, and that customers often accept OIDC when offered. One commenter argues OAuth2 is "about a billion times better than SAML." A minority point out that SAML's disconnected-network topology remains relevant for some air-gapped or embedded systems.