SAML is based on SOAP no? SOAP that google dropped for security and overcomplexity concern while security studies tends to say the bigger risk is using system you cannot fully understand, no?<p>It seems to me like modern security by trust in &quot;expert&quot; rather than understanding the basics. But I guess I am wrong in my appreciation?