Hacker News Reader

You must know something about the domain. One time I spent several weeks falling to implement a minimal SAML relying party. Not even an idp. I found the spec to be impenetrable without a baseline understanding of the jargon. All the definitions seemed to be circular like when I end up on a Wikipedia article for some fancy math concept.

View on HN

It's been a while, but I read through the OASIS spec for SAML for my implementation. There is a lot of yak shaving and I also had to implement XML Digital Signatures (XML-DS), and XML Canonicalization (C14N), but overall I don't think it took too long for something that worked, and was a library so I could just give it a key (or PKCS#11 handle) an identity and get back a SAML Assertion, which is fundamentally what I was after. It's available for viewing here [0].

[0] https://github.com/rkeene/saml-idp/blob/master/lib/saml/saml...

Implementing SAML from scratch should take a long time - it's one of the most footgun-prone designs I've ever seen.

'Yak shaving' as a phrase is new to me, and I love it.

Reply on news.ycombinator.com