[SAML2security]
[IDWSFSecPriv]
[NIST-SP800-30]
[Meier09] provides a check list and [Meier08] a short list