How SAML responses are parsed (not specific to Shib)

[Cantor, Scott]

OASIS runs a list, saml-dev at lists.oasis-open.org, for SAML questions like this.

The short answer is that it requires an XML parser to deal with SAML, which is a huge topic itself.

You should under no circumstances whatsoever even consider building your own SAML implementation at this point. If you want a properly built one, there are 3 open source options in 3 different languages (Shibboleth being one), and if you want a bad one, there are lots to choose from, some free and some not.

-- Scott