SAML Protocol Criticized as 'Fractal of Bad Design,' Urged for Deprecation
A new analysis from Trail of Bits argues that the foundational Security Assertion Markup Language (SAML) protocol is overly complex and insecure, advocating for its replacement with modern alternatives like OpenID Connect.
The Security Assertion Markup Language (SAML) protocol, a cornerstone of early Single Sign-On (SSO) implementations, is facing strong criticism for its inherent complexity and design flaws, with researchers calling for its deprecation in favor of more modern authentication standards. A recent analysis by Trail of Bits highlights how SAML's origins and reliance on XML signature validation have created a "fractal of bad design" that is difficult to implement securely and prone to vulnerabilities.
SAML was developed in 2002 by the OASIS Security Services Technical Committee (SSTC). Its foundation in XML, a markup language known for its complexity compared to formats like JSON, immediately presented challenges. The protocol's design-by-committee approach, integrating multiple XML-based security specifications, further contributed to its unwieldy nature. This complexity, while perhaps manageable in controlled academic environments, became a significant hurdle as SAML was adopted by the burgeoning software-as-a-service (SaaS) industry in the early 2000s.
Despite its technical shortcomings, SAML filled a critical need for organizations seeking to manage user access across a growing number of web services. Early adopters, particularly universities like Yale with its Central Authentication Service (CAS) and Internet2 with Shibboleth, paved the way for commercial solutions. Companies such as Ping Identity, OneLogin, and Okta built their businesses largely on the SAML protocol, driving the growth of the multi-billion dollar identity and access management market.
A primary vulnerability highlighted in the analysis is XML Signature Wrapping (XSW) attacks. While research into XSW dates back to at least 2005, a seminal 2012 paper "On Breaking SAML: Be Whoever You Want to Be" demonstrated practical, automated methods for exploiting these weaknesses. These attacks exploit flaws in how SAML messages, which are XML documents, are parsed and validated, allowing attackers to manipulate authentication assertions. The complexity of XML itself, with its numerous potential pitfalls like XXE, entity expansion, and injection vulnerabilities, adds another layer of difficulty for developers trying to implement SAML securely.
The article points out that even widely used libraries like libxmlsec, which handle the intricate XML signature validation, are complex C codebases that are rarely fully scrutinized. This reliance on "gnarly" code means that many fielded SAML implementations are built on shaky foundations, susceptible to attacks that have been known for years. The continued presence of XSW vulnerabilities today underscores the difficulty in securely implementing and maintaining SAML systems.
Beyond signature validation, the sheer verbosity and complexity of XML compared to JSON present ongoing challenges. XML's numerous components—tags, elements, attributes, namespaces, schemas, CDATA, DOCTYPEs—require careful handling, increasing the potential for implementation errors. In contrast, JSON's simpler structure of keys, values, objects, and lists is generally considered easier to parse and less prone to the same kinds of security pitfalls.
Given these persistent issues, the analysis strongly advocates for the deprecation of SAML. Modern alternatives such as OpenID Connect (OIDC), which is built on more contemporary web standards like OAuth 2.0 and JSON Web Tokens (JWT), offer a more streamlined, secure, and developer-friendly approach to authentication and SSO. The trend in recent evaluations of SSO and MFA solutions also emphasizes security controls and phishing resistance, aligning with the benefits offered by newer protocols.
The call for SAML's retirement is not just a technical critique but a pragmatic one, aiming to reduce the attack surface for organizations and simplify the complex landscape of identity management. As the cybersecurity industry continues to evolve, moving away from legacy protocols like SAML is seen as a crucial step towards building more resilient and secure digital infrastructures.