I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0.
ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML security features as well (which I may not understand)
Can someone distill the differences between ADFS and ACS security risks?
- Is token replay handled differently in each?
- Does the difference in protocol support increase or decrease security?
- What is more secure OpenID, OAuth, SAML1 or SAML2, etc...
- Is encryption and hashing done similarly?
- How are key renewals done? (e.g. ADFS will refresh on an interval)
- Can the home realm discovery page be disabled, customized as to not leak IDP's?