On: SAML: A fractal of bad design

[paulddraper]

ODIC cannot operate with a private-network IdP.

SAML can.

In general, SAML is complicated because (1) auth is complicated (2) XML is complicated (3) canonicalization/signatures are complicated.

Some of those are unforced errors, some are historical facts.

[sebazzz → paulddraper]

> ODIC cannot operate with a private-network IdP

Why not? The flow can be entirely client side. OpenID discovery and PAR is optional and those would require direct connections

[paulddraper → sebazzz]

Yes, you could develop a client-side (JavaScript) application to do this.

SAML does not require JavaScript to do that.

[sebazzz → paulddraper]

Neither does OpenID Connect, it is all form submits or GET redirects.