Samly v1.0.0 Released!

Samly is a Plug library that can be used to enable SAML Single-Sign-On authentication in Phoenix applications. It makes use of the esaml library for core SAML request/response handling.

This has been used successfuly to work with the following Identity Providers:

• Okta

• Ping Identity

• OneLogin

• ADFS

• Nexus GO

• Shibboleth

• SimpleSAMLphp

Hopefully, this library provides some help in successful adoption of Elixir in Enterprise/Intranet.

Many thanks to the following contributors (samly and esaml):

• @peterox

• @mxgrn

• @hoodunit

• @calvinb

• @hodak

• @brianmay

• @zwilias

• @tcrossland

• @samterrell

Many others also contributed by using this library, opening Github issues and providing feedback in DM. Please continue to open issues and submit PRs to improve Samly further. Also, share your experience in getting Samly to work with your IdP so others in the community can benefit as well.

Repos:

Samly: GitHub - handnot2/samly: Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications. · GitHub

esaml: GitHub - handnot2/esaml: Erlang SAML library, SSO and SLO, with Cowboy integration · GitHub

Docker based Identity Providers for development purposes:

SimpleSAMLphp: GitHub - handnot2/samly_simplesaml: Docker based SimpleSAMLPhp IDP setup for development purposes. Includes templates for working with Samly Elixir Library enabled SP. · GitHub

Shibboleth: GitHub - handnot2/samly_shibboleth: Shibboleth SAML IdP setup for dev · GitHub

Development Assistance:

Phoenix Application showing Samly usage: GitHub - handnot2/samly_howto: Sample Elixir Phoenix application showing Samly library usage for SSO enablement · GitHub

Hey everyone,

the EEF CNA just published a CVE for esaml:
https://cna.erlef.org/cves/CVE-2026-28809.html

It’s an XXE issue in the SAML handling that can lead to local file reads and potentially SSRF.

We tried reaching out to the maintainers but unfortunately didn’t get a response, and there’s currently no patch available.

If you’re using this library in production, it’s probably worth taking a closer look. And if someone here is interested in stepping up: this might be a good candidate to take over maintenance (fork, patch, and coordinate with the Hex.pm team to transfer ownership).

If a fix gets released, please let us know so we can update the advisory and mark affected versions correctly:
https://cna.erlef.org/contact

Created a blog post on using samly. This includes instructions on setting up a self-hosted Shibboleth SAML Identity Provider that uses OpenLDAP.