An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

learn more… | top users | synonyms

1
vote
1answer
381 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
9
votes
4answers
529 views

Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?

This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
5
votes
2answers
4k views

Verify SAML Response is from a Trusted Source

I'm in the process of making changes to my site so that we can be a SAML 2.0 Service Provider. We will be doing IdP initiated SAML with Out-of-Band account federation. My question is this: Given a ...
4
votes
1answer
587 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
5
votes
2answers
2k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...