Trail of Bits is right about SAML. You still have to support it.

SAML's security record is as bad as Trail of Bits says. Here's why B2B SaaS teams still have to support it, and how to keep the XML out of their own code.