2
votes
1answer
48 views

SAML 2.0 IdP metadata security

Identity Providers (IdP) often provide a metadata file that is used when setting up SAML. This file needs to be entered into a Service Provider (SP). Do we need to keep this metadata file private and ...
0
votes
1answer
64 views

OIOSAML: assertion consumer does not work

I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL, where I specified URL, on which ...
3
votes
1answer
82 views

SAML, and forcing a re-authentication

I have a use case forced upon me by industry regulation. I wish it wasn't there, but it is. A user logs in to my service, navigates around, etc. The user can perform many actions, but one of the ...
0
votes
1answer
86 views

SAML2 encryption

I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today: User ...
4
votes
2answers
2k views

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
0
votes
2answers
225 views

In a SAML2 FSSO Web Browser profile (HTTP POST), should the IdP analyse the AuthnRequest before asking the user to authenticate? [closed]

Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO. If the IdP gets an <AuthnRequest> from the SP, should / must / can the IdP do the user authentication first, or ...
4
votes
2answers
4k views

How is SAML solving the cross domain single sign-on problem?

Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and ...
8
votes
4answers
3k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
0
votes
1answer
1k views

How do I change the certificate of a Shibboleth service provider?

How do I change the certificate of a Shibboleth service provider? I have an existing identity provider (IDP) and service provider (SP) and I need to replace the certificate with a Verisign signed ...
1
vote
1answer
316 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
0
votes
1answer
1k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...