When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...