XML-DSIG is probably one of the 3 worst cryptosystems ever designed (don't ask me what the other two are, I'm just sure XML-DSIG is one of them) and the system is so complicated that a huge percentage of the deployed base of SAML systems, regardless of their language and library choices, backend onto the same ancient libxmlsec codebase.
If I could avoid doing SAML (we have so far!), I would avoid doing so as long as I could.
If I could avoid doing SAML (we have so far!), I would avoid doing so as long as I could.