|
What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the server that was generating the SAML requests? Could they then later replicate sending the requests on their own machine, or do identity providers have more tricks up their sleeves? I'm trying to weigh the pros and cons of various SSO approaches. Thanks! |
||||
|
|
|
The scenarios you mention would all be a problem with SAML and would be with just about any SSO method. If someone has root access on a server or has acquired the private keys, the security of the system is significantly if not completely compromised. When you are delegating authentication, any compromise in trust can invalidate part or all of the assurance process. If a private key has been compromised, no assertion made by the idP can be trusted. That said, if an attacker gains root privilege on a server, you probably have much bigger problems to deal with anyway. In the case of the RSA SecurID compromise, a number of people have tried to minimize the impact and are saying it will not kill SecurID. However, these people are overlooking that the fact that these hackers had such extensive access to do what they did would make it difficult for RSA to prove that we can trust their authentication products. |
|||
|
|
