Roland Hedberg
- Wrote pysaml2, the Python SAML 2.0 implementation shipped in many distributions
- Wrote pyoidc, a certified Python OpenID Connect implementation
- Built the OpenID Connect conformance test suite work and IdP proxy for Swedish federation
Bio
Roland Hedberg has worked in the research and education community since 1987. He wrote pysaml2, the Python SAML 2.0 implementation still packaged by many operating systems, and later pyoidc, a certified Python OpenID Connect implementation, alongside work on the OpenID Connect conformance test suite and an identity provider proxy for Swedish federation.
Profile built from public project, certification, and university records.
Where their work shows up
Research and education federation runs on open-source code written by people inside it, because no vendor was going to serve thousands of universities with no common budget. pysaml2 and pyoidc are that code for the Python ecosystem, and the conformance test work matters just as much: certification is what turns "we implemented the spec" into something a federation operator can verify. See SAML vs OIDC and the standards deep-dives.
Related on Start with Identity
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025