sign and/or encrypt SAML assetions, hack MITM

[Peter Schober]

Dave Perry via users <users at shibboleth.net> [2024-02-22 09:26 CET]:
> There is a PHP one (simpleSamlPHP)

Sure. FWIW, there's also https://www.php-saml-sp.eu/ (much less widely
known and much, much simpler) that has successfully completed an
external code security audit a while back.

> it can also do IdP mode
> (no idea why you'd use that though).

I'll bite: Because SimpleSAMLphp it's comparably lightweight, easily
runs in various environments (where running a Java Servlet Container
may be more involved) and deployment of PHP applications generally is
"copy some files over to the server (any way you like)".
Feature-wise it's not far behind, sometimes even ahead.
(The main downside to me is the comparably small -- and rather
reticent -- deployer community and an even smaller set of developers,
since UNINETT/Sikt stopped financing development after many years.)

But all this (the larger question of what SAML implementations to
recommend) is moot, of course, because vendors will use what they will
use and often it won't be good (as we know from experience).

And recommending the Shibboleth SP is going to be harder and harder in
the current situation (due to xerces-c++) but possibly also more
fundamentally due to the way people deploy software stacks these days.

-peter