IdeaWell

Project ideas from Hacker News discussions.

SAML: A Fractal of Bad Design

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1 – Enterprise customers insist on SAML support; lacking it makes a product non‑viable
- “Eh, if you don’t have SAML support, I can find a product that does. Not a problem.” – ocdtrekkie
- “You either work with what we use or you are not viable as a product for our need.” – ocdtrekkie

Theme 2 – SAML is seen as outdated, insecure, or merely security theatre; OIDC is preferred
- “That mindset is indicative of security theatre to me.” – jeltz
- “Saml is just not reasonable in our modern security environment.” – tomjen3
- “You think companies that care about security should not care about integrating with flawed protocols?” – eximius

Theme 3 – Vendors weigh the market size vs. development cost when deciding to implement SAML
- “Honestly, it's an addressable market versus development cost question… How many clients will you lose if you support OIDC but not SAML?” – clhodapp
- “Finding out a company wants several grand to flip the ‘allow SAML’ switch on the tenant config, and a few thousand a year in additional licensing to leave it on.” – ocdtrekkie

🚀 Project Ideas

Generating project ideas…

SAML-OIDC Bridge Service

Summary

  • Provides a lightweight reverse‑proxy that translates OIDC flows (used by modern IdPs) into SAML assertions for SaaS apps that lack native SAML support.
  • Eliminates the need for vendors to implement SAML themselves, cutting integration cost and removing the “several grand to flip the SAML switch” pain point.

Details

Key Value
Target Audience SaaS vendors wanting enterprise SSO without SAML expertise
Core Feature OIDC‑to‑SAML translation with configurable attribute mapping and signature handling
Tech Stack Go (or Node.js), Docker, Envoy proxy, OpenSAML library
Difficulty Medium
Monetization Revenue-ready: SaaS subscription per active IdP (e.g., $49/mo per connection)

Notes

  • ocdtrekkie complained: “Finding out a company wants several grand to flip the 'allow SAML' switch…”. This bridge removes that cost.
  • ocdtrekkie also noted vendors “have no idea how SAML works”; the bridge abstracts that complexity away.
  • Potential for discussion: open‑source core with hosted premium tier; addresses both vendor cost and customer frustration with opaque SAML pricing.

SAML Compliance & Testing Toolkit

Summary

  • Automated test suite that validates SAML assertions, signatures, and bindings against common IdPs (Azure AD, Okta, Google) and generates compliance reports.
  • Helps SaaS teams verify their SAML implementation without deep SAML knowledge, reducing support tickets and costly back‑and‑forth.

Details

Key Value
Target Audience SaaS product teams integrating SAML for enterprise customers
Core Feature CI/CD plugin that runs SAML test vectors (signed/unsigned, POST/Redirect, attribute mapping) and outputs a pass/fail report
Tech Stack Python, PySAML2, Docker, GitHub Actions (or GitLab CI)
Difficulty Low-Medium
Monetization Hobby (open‑source core) with optional paid support/private registry for enterprise teams

Notes

  • ocdtrekkie said vendors “have no idea how SAML works” and rely on distant engineers; this tool gives them immediate feedback.
  • beachy described support contacts “who knows very little about SAML”; the toolkit empowers them to self‑validate.
  • Practical utility: reduces friction in sales cycles, lowers barrier for vendors to adopt SAML confidently.

Unified Identity Federation Hub for SaaS

Summary

  • Central hub that aggregates multiple IdP connections (SAML, OIDC, LDAP) into a single API for SaaS apps, handling token translation, session management, and user provisioning.
  • Removes the need for vendors to maintain separate accounts per IdP and eliminates the “routing the identity connection between two or three other identity providers” headache.

Details

Key Value
Target Audience Enterprise SaaS providers serving customers with heterogeneous IdP landscapes
Core Feature Multi‑protocol federation gateway with admin console for connection management, attribute mapping, and audit logs
Tech Stack Kubernetes, Istio service mesh, Keycloak/Dex as backend, Go APIs, React admin UI
Difficulty High
Monetization Revenue-ready: usage‑based pricing (e.g., $0.01 per active auth transaction) or tiered plans based on number of connections

Notes

  • ocdtrekkie highlighted vendors “routing the identity connection between two or three other identity providers in different various clouds”; this hub consolidates them.
  • bigstrat2003 argued customers expect vendors to work with their constraints; the hub lets vendors satisfy any IdP without custom code.
  • Strong discussion potential: open federation standard, vendor‑neutral, and directly addresses the multi‑IdP complexity frustration expressed in the thread.

Read Later