YHK - yet another hacker news clone

SAML: A Fractal of Bad Design

45 points aray07 1 hour ago 6 comments

ocdtrekkie 33 minutes ago | parent

Eh, if you don't have SAML support, I can find a product that does. Not a problem. \o/

(Or to be more clear, it is mostly unacceptable for an enterprise product to have opinionated decisions about what authentication it works with. You either work with what we use or you are not viable as a product for our need. It's kinda simple. I would expect someone whose authentication was OIDC-based to be similarly dismissive if you told them you only would do SAML.)

jeltz 20 minutes ago | parent

That mindset is indicative of security theatre to me. But as security theatre is common in entrprise IT that does not surprise me.

eximius 12 minutes ago | parent

This is only a reasonable stance at the very surface level.

1. "You either work with what we use" - so whatever organization you represent isn't capable of evaluating and shifting to more secure technologies?

2. "it is mostly unacceptable for an enterprise product to have opinionated decisions about what authentication it works with" - you think companies that care about security should not care about integrating with flawed protocols?

A potential customer making bad choices does not obligate a business to make bad choices for their business.

beachy 3 minutes ago | parent

It seems fair to me.

As a SaaS vendor, interacting with our customers about SAML usually involves:

a) them knowing what they want because they already have SAML-based SSO and it works for them; and

b) our contact on their side being some unfortunate support dude who got given SAML as their subject area for whatever reason, and who knows very little about it, and who is 4 levels in the org away from anyone empowered to make decisions as significant as moving away from SAML.

tomjen3 7 minutes ago | parent

You use Entra. Entra can do jwt’s.

Saml is just not reasonable in our modern security environment.

ocdtrekkie 5 minutes ago | parent

Entra is just allowing the Chinese government in your environment. Why bother with authentication at all?

clhodapp 4 minutes ago | parent

[delayed]