SAML：分形化的糟糕设计

安全认证标记语言（SAML）协议因设计缺陷日益引发安全关切。1SAML由OASIS安全服务技术委员会于2002年创建，融合了S2ML、AuthXML、X-TASS和ITML四个基于XML的安全协议。1然而近年来发现的多个安全漏洞暴露了这一协议的根本弱点。

该协议的核心问题源于其基于XML的架构设计。1XML签名包装（XSW）攻击是最严重的安全威胁，早在2012年就有论文《On Breaking SAML: Be Whoever You Want to Be》系统证明了这一攻击向量的可行性。1此后安全研究人员继续发现新的漏洞：Kelby Ludwig在2018年发现了XML注释绕过漏洞，而到2025年又陆续发现了GitHub Enterprise libxml2漏洞、解析器差异绕过和SAML轮盘赌等多个认证绕过漏洞。1分析人士指出，这些问题的根源在于SAML的过度设计——现有实现仅使用其规范功能的10%。1

OpenID Connect（OIDC）协议已成为现代认证的替代方案。1OIDC 1.0发布于2014年，其采用的JOSE堆栈（包括JWS、JWE、JWK、JWA和JWT）通过RFC 7515-7519标准在2015年完成规范化。1随后，PKCE（Proof Key for Code Exchange）于2015年发布，并在2017年针对移动及原生应用场景进行了更新。1业界专家Thomas Ptacek表示，"SAML的唯一优势是在身份提供商和服务提供商无法直接通信的部署场景中，而OIDC的隐式流程表单提交功能可提供相同效果"。1

已有企业开始行动——Fly.io和Tailscale已采用OIDC替代SAML。1相关分析文章呼吁服务商停止采纳SAML协议，同时敦促身份提供商制定弃用计划。1

A critical technical analysis has identified fundamental design flaws in the SAML authentication protocol, arguing that its complexity and recurring security vulnerabilities render it obsolete for modern use cases.1 Created in 2002 by the OASIS Security Services Technical Committee, SAML synthesized four XML-based security protocols—S2ML, AuthXML, X-TASS, and ITML—into a unified standard.1 However, the protocol's reliance on XML as its underlying format has proven to be a persistent source of vulnerability, with XML Signature Wrapping (XSW) attacks representing the most critical security concern, first systematically demonstrated in a 2012 paper titled "On Breaking SAML: Be Whoever You Want to Be."1

Security researchers have continued to expose SAML vulnerabilities throughout its operational history. Kelby Ludwig discovered an XML comment bypass vulnerability in 2018,1 and 2025 has seen multiple authentication bypass exploits emerge, including issues related to GitHub Enterprise's libxml2 vulnerability, parser differential attacks, and what has been termed "SAML roulette."1 An analysis suggests that 99 percent of current SAML implementations utilize only 10 percent of the protocol's feature set, indicating widespread overengineering.1 Security researcher Thomas Ptacek has argued that SAML's primary advantage—enabling deployment scenarios where identity providers and service providers cannot communicate directly—can be replicated through OpenID Connect's implicit flow form submission mechanism, eliminating a key justification for SAML adoption.1

The analysis advocates for a migration to OpenID Connect 1.0, released in 2014, which operates through the JOSE stack (JWS, JWE, JWK, JWA, and JWT) standardized across RFC 7515-7519 in 2015.1 PKCE, introduced in 2015 and refined in 2017 for mobile and native applications, provides modern security mechanisms absent from SAML's design.1 Industry adoption of this transition is already underway, with companies including Fly.io and Tailscale having replaced SAML with OIDC.1 The analysis calls for service providers to cease SAML adoption and for identity providers to establish formal deprecation timelines.1