An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

learn more… | top users | synonyms

0
votes
1answer
72 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
5
votes
3answers
285 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
3
votes
1answer
15 views

Does SAML 2.0 define how to pass only username from SP to IDP?

I am looking at a use case where the service provider will need to capture the user id (not password) to identify the target IDP. In this case, the requirement is to send the user id (that is already ...
3
votes
2answers
354 views

Where should a keystore (.jks) be stored in a repository

I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
0
votes
1answer
40 views

How can I test my SSO connection without having access to the Identity Provider?

I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP). I don't have access to an ...
1
vote
1answer
78 views

Does SAML 2.0 define how to pass username and password for authentication?

I'm aware of how SAML is used for single sign on (SSO). That is, redirection to IDP from SP and getting the user's identity from the SAML response/assertion. My question is: Does SAML 2.0 ...
1
vote
0answers
57 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
1
vote
0answers
32 views

Different timezone in WebSSO using ADFS as IDP

Is there a best practise when it comes to handling timezones in an international single-sign-on solution? I've been asked to include the clients timezone in our saml-ticket as an attribute. This will ...
2
votes
2answers
489 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
3
votes
1answer
88 views

Automated SAML authentication without user interaction

I'm required to integrate my website with SAML authentication, so that any login done to my website, the credentials will be validated by a specific idp (known in advance) Even after reading many ...
7
votes
2answers
15k views

How to achieve seamless SSO without having the user to login again (SAML 2.0 & ADFS using OpenSSO)

We need to implement seamless SSO with ADFS SAML 2.0 using OpenSSO & we plan to go with IdP initiated GET binding. The user in client network will log in to ADFS with Windows credentials once ...
1
vote
0answers
156 views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
0
votes
0answers
21 views

Are there any known weaknesses in SignedXml by Microsoft for SAML?

SingedXml is a common way to verify the signature for SAML in .Net applications. I am wondering if it secure enough, i.e. there is no way to trick it (by making it verify not top-level Assertion or ...
2
votes
1answer
56 views

SAML without certificate

A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes? Is this a ...
4
votes
1answer
66 views

SAML 2.0 Multiple AuthnStatements

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
3
votes
1answer
593 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
1
vote
1answer
395 views

Why should I trust a JSON Web Token (JWT)?

In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For ...
0
votes
1answer
211 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
2
votes
1answer
190 views

Why not use same certificate for webserver TLS and Signing in SAML?

I have read a bit about configuring shibboleth, and recommendations for SAML at internet2 I get the point that a certificate does not have to be signed when used for SAML, because actually only the ...
0
votes
0answers
190 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
-1
votes
1answer
443 views

Authorization/authentication strategy for micro service apps

How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective? E.g: Assume a shopping site which has many micro ...
1
vote
1answer
104 views

OAuth & SAML integration or better approach

Could anyone explain what would be the best approach for this scenario?: There are 2 separate Service Providers: System A is a server that works as a rest API for a mobile application. System B is ...
2
votes
0answers
153 views

Can a service provider communicate directly with an identity provider?

I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity ...
1
vote
1answer
8k views

SAML and kerberos what to use where [closed]

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ? Can somebody highlight their differences and point which ...
1
vote
1answer
161 views

Enterprise Security : Where to Start? [closed]

I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far ...
3
votes
0answers
2k views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
0
votes
1answer
339 views

Is it valid to have more than 1 <saml:assertions> in a SAML Token response

I am trying to provide compatibility between an existing SAML token system with JWT token schema. The current system generates SAML tokens with a structure as follows: Is it even valid to have more ...
1
vote
0answers
131 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
2
votes
2answers
242 views

Should every SAML identity provider provide a unique public certificate to the service provider?

When accepting public keys from someone setting up an identity provider for access to resources protected by a service provider using SAML 2.0, do you absolutely need to have a unique certificate? Is ...
3
votes
1answer
304 views

SAML 2.0 IdP metadata security

Identity Providers (IdP) often provide a metadata file that is used when setting up SAML. This file needs to be entered into a Service Provider (SP). Do we need to keep this metadata file private and ...
0
votes
2answers
3k views

Authenticate WCF call to ADFS through Web Application Proxy (WAP)

Currently we authenticate WCF calls TO a service via ADFS, using the following procedure: Firstly, we get a SAML token from ADFS using (var factory = new WSTrustChannelFactory( new ...
0
votes
1answer
451 views

OIOSAML: assertion consumer does not work

I wrote a simple system with SP-initiating Web SSO scenario based on OIOSAML. To test the system, I deployed it on the remote host. However AssertionConsumerServiceURL, where I specified URL, on which ...
5
votes
1answer
1k views

SAML, and forcing a re-authentication

I have a use case forced upon me by industry regulation. I wish it wasn't there, but it is. A user logs in to my service, navigates around, etc. The user can perform many actions, but one of the ...
8
votes
3answers
4k views

SAML2 vs. OAuth - What are some reasonable relationships?

I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider. We are considering adding OAuth in order to support some ...
3
votes
1answer
364 views

SAML and OpenID, centralized and decentralized

I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID. I find it difficult to understand the difference between the two, ...
5
votes
2answers
856 views

Combining capability-based access control with SAML

I have been looking into various research on identity, PKI and access control trying to boil it down to a simplified methodology for IAM (Identity & Access Management). One thing which pops up in ...
1
vote
2answers
1k views

Do I have to validate Saml2 InResponseTo?

I'm implementing a SAML2 Service provider that will be running on a public facing web site. The sign in functionality is publicly available, so anyone can get hold of a AuthnRequest from my site. ...
3
votes
1answer
374 views

SAML for transporting authorization information

I'm thinking of using SAML for sending authentication and authorization information to system. I plan to send roles and other information as authentication attributes in the assertion. Does this ...
1
vote
1answer
220 views

SAML2 encryption

I am new to SAML2 and have a question. We have a customer that is saying that they want to encrypt the user data they are sending to us. Here is an overview of how I have this implemented today: User ...
1
vote
1answer
154 views

The need for created timestamp in tokens

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is ...
0
votes
2answers
436 views

In a SAML2 FSSO Web Browser profile (HTTP POST), should the IdP analyse the AuthnRequest before asking the user to authenticate? [closed]

Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO. If the IdP gets an <AuthnRequest> from the SP, should / must / can the IdP do the user authentication first, or read/...
1
vote
1answer
615 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
13
votes
4answers
5k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
5
votes
2answers
14k views

How is SAML solving the cross domain single sign-on problem?

Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and ...
1
vote
3answers
350 views

Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP. Should banks offer integration with services like OpenID, WS-Fed, or ...
5
votes
2answers
700 views

Shibboleth user attribute encryption

How does Shibboleth guarantee that 3rd parties do not get access to user attributes contained in SAML 2.0 assertion exchanged between IdP and SP? Is it correct that all user attributes are encrypted ...
0
votes
1answer
2k views

How do I change the certificate of a Shibboleth service provider?

How do I change the certificate of a Shibboleth service provider? I have an existing identity provider (IDP) and service provider (SP) and I need to replace the certificate with a Verisign signed cert....
1
vote
1answer
574 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
9
votes
1answer
9k views

What is the purpose of AudienceRestriction in SAML 2.0?

Having read through the core specification for SAML 2.0 section 2.5.1.4 (page 23) I still cannot fully understand the purpose of the AudienceRestriction tag and what problem it is attempting to ...
1
vote
1answer
3k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...