Hacker News Reader

Comment by 8n4vidtmkvmk | Hacker News Reader

So not a weekend project but not crazy hard. Probably still rules it out for my hobby apps.

A weekend project is probably fine -- I wrote a Passkey-based SAML IdP in a weekend (re-using the SAML IdP from a different project). It's written in Tcl.

The hardest part of dealing with the Passkeys was remembering to read the whole specification before implementing it -- I spent a lot of time parsing their CBOR/COSE-based specification so that I could get the public key before "discovering" that there was a method for that defined by the specification.

You must know something about the domain. One time I spent several weeks falling to implement a minimal SAML relying party. Not even an idp. I found the spec to be impenetrable without a baseline understanding of the jargon. All the definitions seemed to be circular like when I end up on a Wikipedia article for some fancy math concept.

It's been a while, but I read through the OASIS spec for SAML for my implementation. There is a lot of yak shaving and I also had to implement XML Digital Signatures (XML-DS), and XML Canonicalization (C14N), but overall I don't think it took too long for something that worked, and was a library so I could just give it a key (or PKCS#11 handle) an identity and get back a SAML Assertion, which is fundamentally what I was after. It's available for viewing here [0].

[0] https://github.com/rkeene/saml-idp/blob/master/lib/saml/saml...

Implementing SAML from scratch should take a long time - it's one of the most footgun-prone designs I've ever seen.

'Yak shaving' as a phrase is new to me, and I love it.

Reply on news.ycombinator.com