tl;dr: SAML, the XML-based SSO protocol that powered the rise of Okta, Ping, and OneLogin, is buckling under its own complexity—particularly around XML canonicalization, enveloped signatures, and a bloated "kitchen-sink" spec that has enabled a steady stream of authentication bypass vulnerabilities through 2025. The author argues SAML's design assumptions (transport independence, disconnected IdP/SP topologies) are obsolete in an HTTPS-everywhere, zero-trust world, and that OIDC—which grew organically via focused RFCs—covers every real use case. Recommendation: vendors should stop onboarding new SAML integrations and migrate customers to OIDC.