Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today:

User logs on to their Intranet site and clicks on a link to our company. They use PingFederate Single Sign-On (SSO) to generate the SAML2 request. They send the username in the Subject.NameId section. When we receive the SAML2 request, we decrypt the information that they sent using their certificate.

The change that they want is to encrypt the section using our key and we will decrypt this section on our side. This is being used just for a one-sided SSO process, and we don't need to send anything back to them.

I just wanted to reach out and see if this is the correct way of doing SAML2 or not. The way that I have it setup is I look at incoming SAML2 request and determine what certificate to use that is on our server, and use what the customer has given to us. Another thing that he said is that the way that we have this implemented is not really SAML2.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

There are a few options here.

You could very easily just have them encrypt the assertion itself, which is supported by most commercial solutions. This leads to better/more stable interop, but it will encrypt the entire assertion not just the given attributes. It's usually an asymmetric operation with them using your public key.

Another option is to use an EncryptedAttribute, which isn't something I've seen implemented in many places, but it allows you to specify encryption on an attribute-by-attribute basis, and is supported by the SAML spec.

The last option is to encrypt it out-of-band and leave it up to your application to decrypt it manually. This isn't defined by any specs and is left up to you design and implement. I would avoid this for the usual "don't roll your own" reasons.

I think these options are ordered in least-to-most complexity, IMO.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.