<turbo-stream action="append" target="posts_list"><template>    <div class="postbit" id="119623" data-post-id="119623">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="handnot2" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/handnot2/120/8358_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  handnot2
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<h1><a name="p-119623-samly-v100-released-1" class="anchor" href="#p-119623-samly-v100-released-1" aria-label="Heading link" rel="nofollow"></a>Samly v1.0.0 Released!</h1>
<p><code>Samly</code> is a Plug library that can be used to enable SAML Single-Sign-On authentication in Phoenix applications. It makes use of the <code>esaml</code> library for core SAML request/response handling.</p>
<p>This has been used successfuly to work with the following Identity Providers:</p>
<ul>
<li>
<p>Okta</p>
</li>
<li>
<p>Ping Identity</p>
</li>
<li>
<p>OneLogin</p>
</li>
<li>
<p>ADFS</p>
</li>
<li>
<p>Nexus GO</p>
</li>
<li>
<p>Shibboleth</p>
</li>
<li>
<p>SimpleSAMLphp</p>
</li>
</ul>
<p>Hopefully, this library provides some help in successful adoption of Elixir in Enterprise/Intranet.</p>
<p>Many thanks to the following contributors (<code>samly</code> and <code>esaml</code>):</p>
<ul>
<li>
<p><span class="mention">@peterox</span></p>
</li>
<li>
<p><a class="mention" href="/u/mxgrn" rel="nofollow">@mxgrn</a></p>
</li>
<li>
<p><span class="mention">@hoodunit</span></p>
</li>
<li>
<p><span class="mention">@calvinb</span></p>
</li>
<li>
<p><a class="mention" href="/u/hodak" rel="nofollow">@hodak</a></p>
</li>
<li>
<p><a class="mention" href="/u/brianmay" rel="nofollow">@brianmay</a></p>
</li>
<li>
<p><span class="mention">@zwilias</span></p>
</li>
<li>
<p><span class="mention">@tcrossland</span></p>
</li>
<li>
<p><span class="mention">@samterrell</span></p>
</li>
</ul>
<p>Many others also contributed by using this library, opening Github issues and providing feedback in DM. Please continue to open issues and submit PRs to improve <code>Samly</code> further. Also, share your experience in getting <code>Samly</code> to work with your IdP so others in the community can benefit as well.</p>
<p><strong>Repos</strong>:</p>
<p><code>Samly</code>: <a href="https://github.com/handnot2/samly" class="inline-onebox" rel="noopener nofollow ugc">GitHub - handnot2/samly: Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications. · GitHub</a></p>
<p><code>esaml</code>: <a href="https://github.com/handnot2/esaml" class="inline-onebox" rel="noopener nofollow ugc">GitHub - handnot2/esaml: Erlang SAML library, SSO and SLO, with Cowboy integration · GitHub</a></p>
<p><strong>Docker based Identity Providers for development purposes</strong>:</p>
<p><code>SimpleSAMLphp</code>: <a href="https://github.com/handnot2/samly_simplesaml" class="inline-onebox" rel="noopener nofollow ugc">GitHub - handnot2/samly_simplesaml: Docker based SimpleSAMLPhp IDP setup for development purposes. Includes templates for working with Samly Elixir Library enabled SP. · GitHub</a></p>
<p><code>Shibboleth</code>: <a href="https://github.com/handnot2/samly_shibboleth" class="inline-onebox" rel="noopener nofollow ugc">GitHub - handnot2/samly_shibboleth: Shibboleth SAML IdP setup for dev · GitHub</a></p>
<p><strong>Development Assistance</strong>:</p>
<p>Phoenix Application showing <code>Samly</code> usage: <a href="https://github.com/handnot2/samly_howto" class="inline-onebox" rel="noopener nofollow ugc">GitHub - handnot2/samly_howto: Sample Elixir Phoenix application showing Samly library usage for SSO enablement · GitHub</a></p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="119623" data-batch-url="/posts/batch_likers">
                        8
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/42">Post #41</a>
	                </div>
	            </div>
              <div id="likers-container-119623" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="119623"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #41"></div>
  </section>
</div>
    <div class="postbit" id="122643" data-post-id="122643">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="handnot2" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/handnot2/120/8358_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  handnot2
                    <span class="op-star" title="Thread Starter">
                      <img alt="OP" class="op-star-icon" src="/assets/thread-icons/thread-icon-thread-starter-df91e872.png" />
                    </span>
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<h3><a name="p-122643-pre-100-versions-retired-1" class="anchor" href="#p-122643-pre-100-versions-retired-1" aria-label="Heading link" rel="nofollow"></a>Pre 1.0.0 versions retired</h3>
<p>All <code>Samly</code> versions <strong>prior</strong> to <code>v1.0.0</code> are marked as “retired” in Hex. Hopefully whoever is using <code>Samly</code> is on <code>v1.0.0</code>. If you are still using earlier versions, you might see a mix warning message. It should not break your usage though.</p>
<p>Moving forward, <code>v1.0.0</code> and above will be active.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="122643" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/43">Post #42</a>
	                </div>
	            </div>
              <div id="likers-container-122643" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="122643"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #42"></div>
  </section>
</div>
    <div class="postbit" id="194508" data-post-id="194508">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="arton" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/arton/120/9244_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  arton
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p><a class="mention" href="/u/handnot2" rel="nofollow">@handnot2</a> Hi, we’re considering using Samly for a project, but were wondering about its maintenance status. Would it be better for us to fork and maintain separately or is Samly still considered actively maintained?</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="194508" data-batch-url="/posts/batch_likers">
                        2
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/44">Post #43</a>
	                </div>
	            </div>
              <div id="likers-container-194508" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="194508"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #43"></div>
  </section>
</div>
    <div class="postbit" id="284984" data-post-id="284984">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="Nezteb" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/Nezteb/120/30092_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  Nezteb
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>For what it’s worth, I’m aware of two active forks of both <code>esaml</code> and <code>samly</code>:</p>
<ul>
<li><a href="https://github.com/dropbox/esaml" rel="noopener nofollow ugc">https://github.com/dropbox/esaml</a></li>
<li><a href="https://github.com/dropbox/samly" class="inline-onebox" rel="noopener nofollow ugc">GitHub - dropbox/samly: Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications. · GitHub</a></li>
</ul> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="284984" data-batch-url="/posts/batch_likers">
                        3
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/45">Post #44</a>
	                </div>
	            </div>
              <div id="likers-container-284984" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="284984"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #44"></div>
  </section>
</div>
    <div class="postbit" id="385466" data-post-id="385466">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="maennchen" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/maennchen/120/32742_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  maennchen
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Hey everyone,</p>
<p>the EEF CNA just published a CVE for <strong>esaml</strong>:<br>
<a href="https://cna.erlef.org/cves/CVE-2026-28809.html" rel="noopener nofollow ugc">https://cna.erlef.org/cves/CVE-2026-28809.html</a></p>
<p>It’s an XXE issue in the SAML handling that can lead to local file reads and potentially SSRF.</p>
<p>We tried reaching out to the maintainers but unfortunately didn’t get a response, and there’s currently no patch available.</p>
<p>If you’re using this library in production, it’s probably worth taking a closer look. And if someone here is interested in stepping up: this might be a good candidate to take over maintenance (fork, patch, and coordinate with the Hex.pm team to transfer ownership).</p>
<p>If a fix gets released, please let us know so we can update the advisory and mark affected versions correctly:<br>
<a href="https://cna.erlef.org/contact" rel="noopener nofollow ugc">https://cna.erlef.org/contact</a></p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="385466" data-batch-url="/posts/batch_likers">
                        8
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/46">Post #45</a>
	                </div>
	            </div>
              <div id="likers-container-385466" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="385466"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #45"></div>
  </section>
</div>
    <div class="postbit" id="385637" data-post-id="385637">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="slouchpie" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/slouchpie/120/34819_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  slouchpie
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>If anyone is actively working on a fix in their own fork, please say here. I am going to fork and try to fix as a temporary band-aid for the CVE. I don’t have bandwidth to be a maintainer.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="385637" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/47">Post #46</a>
	                </div>
	            </div>
              <div id="likers-container-385637" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="385637"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #46"></div>
  </section>
</div>
    <div class="postbit" id="385678" data-post-id="385678">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="slouchpie" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/slouchpie/120/34819_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  slouchpie
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Here is Jump’s fork of esaml: <a href="https://github.com/Jump-App/esaml" class="inline-onebox" rel="noopener nofollow ugc">GitHub - Jump-App/esaml: Erlang SAML library, SSO and SLO, with Cowboy integration · GitHub</a></p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="385678" data-batch-url="/posts/batch_likers">
                        3
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/48">Post #47</a>
	                </div>
	            </div>
              <div id="likers-container-385678" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="385678"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #47"></div>
  </section>
</div>
    <div class="postbit" id="386291" data-post-id="386291">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="maennchen" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/maennchen/120/32742_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  maennchen
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>Thanks for writing a patch. I’ve updated the CVE to include it.</p>
<aside class="onebox allowlistedgeneric" data-onebox-src="https://cna.erlef.org/cves/CVE-2026-28809.html">
  <header class="source">
      <img src="https://cna.erlef.org/assets/images/android-icon-192x192.png" class="site-icon" alt="" width="192" height="192">

      <a href="https://cna.erlef.org/cves/CVE-2026-28809.html" target="_blank" rel="noopener nofollow ugc">Erlang Ecosystem Foundation CNA</a>
  </header>

  <article class="onebox-body">
    

<h3><a href="https://cna.erlef.org/cves/CVE-2026-28809.html" target="_blank" rel="noopener nofollow ugc">XXE in esaml SAML library allows local file read and potential SSRF</a></h3>

  <p>This project handles the CVE Numbering Authority (CNA) for the Erlang Ecosystem Foundation (EEF).</p>


  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>
 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="386291" data-batch-url="/posts/batch_likers">
                        2
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/49">Post #48</a>
	                </div>
	            </div>
              <div id="likers-container-386291" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="386291"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-standard-post cat-standard-post" title="Post #48"></div>
  </section>
</div>
    <div class="postbit" id="392877" data-post-id="392877">
  <section>
    <div class="post-wrap">


					<div class="post-header">
		        <div class="user-avatar">
		          <img alt="maennchen" src="https://forum.elixirforum.com/user_avatar/forum.elixirforum.com/maennchen/120/32742_2.png" width="120" height="120" />
		        </div>
					
						<div class="user-details">
		          <div class="user-name">
		            <h3>
                  maennchen
                  </h3>
		          </div>
						
						</div>
					
					</div>

	        <div class="thread-main">
	            <div class="post-body" data-turbo="false">
								<p>There will be two more advisories on samly itself that have gotten no reply to the reports.</p>
<p>If anybody would like to create a fork and patch the advisories before the CVEs go live, let me know.</p> 
	            </div>

	            <div class="base-line">
	                <div class="thread-counters">
	                    <span class="thread-count count-likes js-likers-trigger" title="Likes" data-post-id="392877" data-batch-url="/posts/batch_likers">
                        1
                      </span>
                      <!-- <span class="thread-count js-solved-indicator" title="Marked as solution"></span> -->
	                </div>
	                <div class="go-to-post">
	                  <a title="Go to post" alt="Go to post" href="https://forum.elixirforum.com/t/samly-add-saml-sso-to-your-phoenix-application-now-with-multiple-identity-provider-support/8511/50">Post #49</a>
	                </div>
	            </div>
              <div id="likers-container-392877" 
                   class="likers-container"
                   data-first-post="false"
                   data-batch-url="/posts/batch_likers">
                   <div class="likers-placeholder" 
                     data-likers-post-id="392877"
                     data-batch-url="/posts/batch_likers">
                  <div class="post-likers"></div>
                </div>
              </div>
	        </div>
			

    </div>

    <div class="triangle-top-right type-last-post cat-last-post" title="Last post!"></div>
  </section>
</div>
</template></turbo-stream><turbo-stream action="replace" target="load-more-container"><template><div id="load-more-container" class="load-more-container">
    <span class="all-loaded">— All posts loaded —</span>
</div></template></turbo-stream>