So, unfortunately for a while now, a few companies have asserted that they hold IP (Intellectual Property, typically in the form of issued patents) that applies to various aspects of SAML. RSA Security is one of these companies, and it even went so far as to “require” those implementing SAML to fill-out a license application form and submit it to them. Thankfully, RSA has now decided to abandon this practice and adopt a “defensive suspension” IP posture with respect to SAML. Hopefully, other companies whose SAML patent statements are not (yet) explicitly of the “defensive suspension” form will also adopt this posture. Such asserted patent statements have been a sticking point with various slices of the open source community, and hopefully this revision will help aid SAML adoption in such communities.
[…] UP-DATE to the UP-DATE: Jeff Hodges, another esteemed former co-chair of the SSTC, comments further on the positive RSA IPR news. He also notes Google’s SAML-based single sign-on in their search appliance product. To me, Google’s usage of SAML looks remarkably robust, and their SPI documentation can function as another handy entry point into understanding how to do this stuff. […]