Architecturally speaking, why might an organization deploy a SAML-based Web SSO solution if they already have a cookie-based Web SSO in place and working?

 

SAML generally performs better and requires less network overhead. 

SAML supports federation across cookie domains. 

SAML is required for Web Service security, which makes it a natural replacement for cookie based SSO solutions. 

SAML is immune to man-in-the-middle attacks.