The root problem with SAML is there’s a million and one permutations to do the same thing.

Signed assertions. Signed messages. Encrypted messages. Encrypted assertions. Sign after normalization. Sign before normalization. Encrypt then sign. Sign then encrypt.

There’s too many ways to do too many things.