SAML 设计缺陷催生迁移潮
推荐指数 59.0 NO. 018 · 2026.09.23
发布2026/09/22Score76Comments22
为什么值得看
SAML 协议因学术委员会设计、XML 过度复杂和实现漏洞频发，正被企业加速弃用。AI 工程师若负责 B2B 产品企业集成，需优先支持 OIDC 以缩短销售周期。
编辑判断
SAML 的死亡螺旋不是技术问题而是生态问题：企业 IT 采购流程长导致存量系统难以迁移，但新入场的 SaaS 厂商已普遍默认 OIDC 优先。做 B2B AI 工具的团队要注意，支持 SAML 往往意味着额外 2-4 周的安全审计和定制开发，而 OIDC 可以用 Auth0、WorkOS 等现成方案几天搞定。
更隐蔽的风险是 SAML 的 XML 签名绕过漏洞（如 2018 年的 CVE-2017-11427 系列）仍在被利用，合规审计越来越严格。如果你在做面向金融、医疗等强监管行业的 AI 产品，把 OIDC 作为默认选项、SAML 作为付费增值功能，是更健康的商业模式。
社区反馈
负面 22 条评论
核心争论：企业集成应坚持支持SAML还是优先OIDC并放弃SAML
Eh, if you don't have SAML support, I can find a product that does. Not a problem. \o/ (Or to be more clear, it is mostly unacceptable for an enterprise product to have opinionated decisions about what authentication it works with. You either work with what we use or you are not viable as a pro
That mindset is indicative of security theatre to me. But as security theatre is common in entrprise IT that does not surprise me.
This is only a reasonable stance at the very surface level. 1. "You either work with what we use" - so whatever organization you represent isn't capable of evaluating and shifting to more secure technologies? 2. "it is mostly unacceptable for an enterprise product to have opinionated decisions about