Scott Cantor
- Did most of the technical editing of the SAML 2.0 specifications at OASIS
- Project architect for Shibboleth and maintainer of its Service Provider software
- Long-running contributor to InCommon and Internet2 middleware
Bio
Scott Cantor did most of the technical editing of the SAML 2.0 specifications at OASIS and has been the architect and long-term maintainer of Shibboleth, the open-source SAML implementation that research and education federations run on. He splits his time between the Shibboleth Consortium, InCommon, Internet2 middleware work, and running single sign-on for Ohio State.
Profile built from public OASIS, consortium, and university records.
Where their work shows up
SAML is often written off as legacy, which ignores that it still carries most enterprise and nearly all research-and-education federation, at a scale of thousands of institutions with no common vendor. Shibboleth is why that federation exists without one, and the precision of the SAML 2.0 text is why implementations from different decades still interoperate. See SAML vs OIDC for how to choose between them today, and the SAML 2.0 deep-dive.
Related on Start with Identity
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025