SAML: A fractal of unhealthy design
Born out of academia and raised in company IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) firms within the late aughts, IT departments wanted a method for customers to authenticate to many new net companies. SAML and the burgeoning single sign-on (SSO) trade fulfilled this want. However, SAML is being crushed underneath the burden of its personal complexity. It’s time to deprecate it and transfer on to fashionable alternate options like OpenID Connect (OIDC). In this submit, I’ll discover the design-by-committee origin of SAML, its development by the ranks in tutorial and company environments, its sluggish disintegration by the hands of the safety analysis group, and its (hopeful) deprecation in favor of newer protocols.
What’s insidious about SAML is that it actually is generally simple to grasp, but it surely’s constructed on a basis of sand, bone mud, and ash; it really works … in the event you assume XML signature validation is dependable. But XML signature validation is deeply cursed, and is so difficult that almost all fielded SAML implementations are wrapping libxmlsec, a gnarly C codebase no one reads.
— Thomas Ptacek, 2023
SAML and the delivery of the SSO trade
Wikipedia tells me that “SAML is an XML-based markup language for safety assertions.” It was created in 2002 by the Organization for the Advancement of Structured Information Standards (OASIS) Security Services Technical Committee (SSTC). Okay, we’re not off to a fantastic begin by fashionable requirements. XML, regardless of having some redeeming qualities, is sort of advanced in comparison with newer alternate options like JSON, however we’ll get extra into that later. Further, a committee of subcommittees having conferences is a recipe for “kitchen-sink” protocol design (e.g., waterfall methodology, big design up front, and so on.). And positive sufficient, we’ve now jammed 4 (!) XML-based safety protocols into one:
… the next mental property was contributed to the SSTC:
- Security Services Markup Language (S2ML) from Netegrity
- AuthXML from Securant
- XML Trust Assertion Service Specification (X-TASS) from VeriSign
- Information Technology Markup Language (ITML) from Jamcracker
However, the will for such a protocol was simple. As the web shifted from Web 1.0 within the 90s to Web 2.0 within the early aughts, customers and organizations wanted a straightforward technique to authenticate to many new net companies. Academia was the most important driver of this motion, though not the one one: Central Authentication Service (CAS) in 2002 at Yale, Shibboleth IdP in 2003 by Internet2, a consortium of analysis universities (including my alma mater), ADFS in 2003 by Microsoft, and simpleSAMLphp around 2007 by Uninett, a state-owned Norwegian firm with shut ties to academia. All these authentication tasks finally supported SAML in a technique or one other. Like ARPANET earlier than it, universities had been on the forefront of web improvement and had been the earliest customers of net companies. Once this base layer of protocol availability and nascent tutorial proving floor was established, the business trade took it and ran towards a multibillion greenback trade.
The SSO, identification, and authentication supplier trade was additionally beginning up within the early aughts, however actually got here to fruition a couple of years later: Ping Identity (2002), OneLogin (2009), Okta (2009), and Duo Security (2010). These firms had been primarily constructed on the SAML protocol except for Duo, who would introduce their first SSO product in 2015, which is the place I come into the story. I labored on Duo’s first on-premises Access Gateway product (DAG), which was constructed on simpleSAMLphp and, clearly, the SAML protocol. It’s the place I turned intimately aware of the SAML protocol and spent a few years of my life digesting its prolonged specs. I used to be there when Kelby Ludwig discovered the XML comment bypass, however we are going to get into varied assaults and SAML deficiencies later. Suffice it to say, the SSO and authentication supplier trade was booming, and far of it was constructed on the SAML protocol.
A crack within the armor
XML signature wrapping (XSW) assaults are the proverbial arrow to SAML’s heel. While there was earlier safety analysis into each signature wrapping (2005, 2008, and 2009) and SAML (2008), I think about the godfather of all of it to be “On Breaking SAML: Be Whoever You Want to Be” (2012). It examined concept in opposition to apply and resulted in an automated way to verify for XSW assaults. This was our north star when implementing the DAG. It was the rationale we selected simpleSAMLphp as our constructing block. PHP, especially at the time, was not precisely identified for its safety monitor document, however simpleSAMLphp’s spoke for itself. simpleSAMLphp was resilient to XSW at a time when no one actually knew what that was:
Despite being entrance and heart on this 2012 paper, XSW is still present today. If we all know the bug class, then why can’t we repair it? But earlier than we get into SAML’s flaws we first have to contemplate the shaky floor it was constructed upon: XML.
XML is not any slouch in relation to a (lack of) safety monitor document. These bug classes would have been extra acquainted to a developer within the 90s, however nonetheless are nonetheless current in XML at the moment: XXE, entity growth (“billion laughs”), DTD retrieval (SSRF), XPath/XQuery/XInclude/XSLT/CDATA injection, and extra. A SAML library must deal with all these bug lessons earlier than even attending to the precise SAML performance.
In addition to safety bug lessons, there’s additionally the sheer complexity of XML in comparison in opposition to one thing like JSON. In XML you will have tags, components, attributes, feedback, namespaces, markup versus content material, schemas, CDATA, DOCTYPEs, and extra. In JSON, you primarily have keys, values, objects, and lists. Complexity is usually at odds with safety, and that is one cause I think about SAML to be a fractal of unhealthy design.
A fractal of unhealthy design
SAML gives ample alternative to find out about protocol design. In this part, I’ll cowl 5 flaws that I think about to be deadly to the long-term viability of SAML as an authentication protocol. These flaws may also be used when designing new authentication protocols. That is, you may both sidestep the flaw, or take its inverse and try to bake that into the protocol.
Built on XML
As talked about above, SAML is constructed on XML, and XML is advanced, however it’s not the committee’s fault. XML is what they’d on the time, and it’s what folks used. JSON was “discovered” in 2001, however this was proper across the time the SAML committee was assembly, and so they’d be unlikely to design an authentication protocol round an experimental new format. Especially when it caters to JavaScript and also you write numerous Java.
One may design a quantitative complexity measurement for XML versus JSON or SAML versus JWT/OIDC (e.g., spec/RFC phrase rely, spec/RFC normative phrase rely, and so on.), however that may require a weblog submit or paper all to itself. In the curiosity of staying on matter, I’ll chorus from doing that right here, and suffice to say that XML is considerably extra advanced than one thing like JSON.
Canonicalization
Canonicalization (C14N) is what you do if you need to take the wild mess that’s XML, compute a hash of it, and get constant outcomes. In different phrases, if the SP and IdP can not agree on a constant illustration of the XML information, then the bytes received’t line up, the signatures received’t match, and your authentication fails. However, that is simpler mentioned than achieved.
Canonicalization bugs enabled Kelby’s XML remark bypass in 2018:
Canonicalization is commonly a precursor to parser differential and/or “round-trip” bugs, that are what most fashionable SAML assaults use:
Enveloped signatures
Enveloped signature considerations are a not-too-distant cousin of canonicalization. In quick, in the event you’re attempting to insert the signature into the information payload that you simply’re signing, you’re going to have a foul time. Let’s evaluate and distinction JWT and SAML on this method:
In the JWT instance above, the blue signature is indifferent from the JSON payload and delimited within the JWT with a interval (“.”). In the SAML instance, the Signature ingredient is inserted (“enveloped”) within the Assertion ingredient. The downside right here is that it is rather tough to get a byte-for-byte, canonically equal illustration of the information when you’re additionally modifying it! Even extra so when you will have a posh format like XML and complicated canonicalization guidelines.
“Kitchen-sink” design
This design deficiency primarily transposes to you aren’t gonna need it (YAGNI). It’s not a wholly truthful characterization as a result of the parts of the SAML specification which might be used within the real-world have modified over the previous 20 years (sorry, SOAP and artifact binding). However, the actual fact of the matter is that 99% of contemporary SAML implementations use a really related information form and subset of the specification. Any given SAML authentication you’d encounter within the wild at the moment in all probability avoids 90% of the specification. This provides vital complexity for largely unused options.
If I used to be including SAML help to one thing new, I’d think about past all the usual SAML checks additionally rejecting any message that doesn’t have the identical form as what Okta, Onelogin, Google, or Shib generates.
— Thomas Ptacek, 2021
Ossification
SAML was designed in a unique period for a unique time and has not obtained essential updates. These considerations will typically be of sensible implication quite than theoretical. What I imply by ossification can roughly be enumerated as the next:
- OIDC assumes HTTP, whereas SAML is transport impartial. Sure, SAML HTTP bindings exist and are mostly used, however they don’t seem to be required. This affords SAML a sure diploma of flexibility, but additionally signifies that flexibility have to be effectively outlined, have to be carried out someplace, and may include bugs. SAML happened at a time when HTTP + TLS was not but the dominant spine of net service communication, and it has by no means reconciled with this contemporary panorama. HTTPS permits OIDC to punt encrypted, trusted communication to the transport layer.
- OIDC typically assumes a related community topology, whereas SAML doesn’t. The commonest OIDC movement (authorization code) assumes the OpenID Provider (OP) and Relying Party (RP) can talk instantly (OIDC OP/RP == SAML IdP/SP). Sure, OIDC implicit flow with form post exists, however it is rather unusual to see at the moment. Further, SAML has artifact binding for direct communication, however it is usually very unusual. The level is that if the OP and RP can talk instantly then that relieves stress off of the authentication response payload to include all the data essential to make an authentication and authorization choice. This reduces payload measurement and complexity. The OIDC OP and RP can as a substitute trade info in a backchannel.
- OIDC grew organically over time, whereas SAML was largely designed up entrance. OIDC encompasses dozens of specs and RFCs that grew organically over a few years. These paperwork had been typically created to unravel a particular want quite than attempting to anticipate all future wants and constructing that up entrance. This is akin to agile methodology versus waterfall, as described within the first part. Consider the next non-exhaustive timeline:
- OpenID Connect 1.0 specification printed (2014)
- JOSE stack finalized for JW{S,E,Ok,A,T} through RFC 7515-7519 (2015)
- PKCE printed through RFC 7636 (2015)
- PKCE for cell/native apps printed through RFC 8252 (2017)
- Device authorization grant for IoT gadgets printed through RFC 8628 (2019)
- Demonstrating proof of possession (DPoP) for MFA workflows printed through RFC 9449 (2023)
- PKCE for SPAs printed through RFC 10017 (2026)
I discover the historic circumstances fascinating too. For instance, SAML got here of age in an period of VPNs and community segmentation, therefore level (2) above. If the IdP or SP was behind a company firewall, and it couldn’t converse on to the opposite finish, then the entire rollout got here to a halt and that vendor misplaced the gross sales deal. SAML wanted to seamlessly account for this case. Google’s BeyondCorp model and zero-trust structure flipped this notion on its head in 2014. Additionally, SAML did not anticipate the cell, SPA, and IoT revolutions, and had no solutions when these applied sciences arrived on the scene within the late aughts. Even although SAML remains to be extensively adopted in company environments, these macroscopic occasions helped begin the lengthy, sluggish decline of the protocol. Agility and free coupling allow speedy adaptation in ever-changing IT environments.
All roads result in OIDC
No protocol is ideal, however when it comes to an answer all roads result in OIDC. As far as I can inform, the one deployment situation the place SAML had a bonus was networks the place the SP and IdP can not talk instantly. OIDC’s implicit movement with type submit gives all the identical components. This is definitely one of many cleanest migration plans I’ve seen out there within the trade.
So what can I do if I’m a service supplier (i.e., SP) and I’d prefer to combine into the SSO ecosystem with out SAML? Just help OIDC. Abandon SAML. Apparently Fly.io and Tailscale are already doing it:
We’ve managed to carry the road on OIDC to date. So has Tailscale. If Tailscale can maintain the road, given who they’re promoting to, I believe most orgs can. Really, attempt to keep away from doing SAML. Remember, as a vendor, you’re typically competing with firms that don’t do actual SSO integration in any respect.
— Thomas Ptacek, 2024
So what can I do if I’m an identification or authentication supplier (i.e., IdP) and I’d like to maneuver off of SAML? Well, relying in your buyer rely, this can be a protracted street certainly. But you understand how you eat an elephant? One chew at a time. This is a well-worn path within the trade: develop a deprecation plan, talk it to prospects, cease onboarding new prospects to SAML integrations, present present SAML prospects with equal OIDC configurations, set a sundown date, and get to work.
SAML had an excellent 25 12 months run. It birthed the SSO trade, helped safe untold numbers of authentications, improved the UX of authenticating to dozens of net companies, and created billions of {dollars} of financial impression. We needs to be grateful to the creators of the SAML protocol. It has supplied us with a fantastic case examine in protocol design and evolution over a really dynamic interval within the tech trade.
If you’d prefer to learn extra about historic analyses of safety matters, then take a look at “Marshal madness: A brief history of Ruby deserialization exploits.”
Contact us in the event you’re occupied with a protocol design audit or would really like a evaluate of your authentication system.
