An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

learn more… | top users | synonyms

4
votes
2answers
19 views

Does SAML 2.0 define how to pass only username from SP to IDP?

I am looking at a use case where the service provider will need to capture the user id (not password) to identify the target IDP. In this case, the requirement is to send the user id (that is already ...
3
votes
2answers
361 views

Where should a keystore (.jks) be stored in a repository

I've got a question about the best practice in storing a Keystore file (.jks) in source control. This Keystore is called by a stand-alone Java component that retrieves a private key for the purpose of ...
4
votes
1answer
66 views

SAML 2.0 Multiple AuthnStatements

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
3
votes
1answer
2k views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
0
votes
1answer
78 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
2
votes
0answers
154 views

Can a service provider communicate directly with an identity provider?

I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity ...
1
vote
0answers
63 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
1
vote
0answers
35 views

Different timezone in WebSSO using ADFS as IDP

Is there a best practise when it comes to handling timezones in an international single-sign-on solution? I've been asked to include the clients timezone in our saml-ticket as an attribute. This will ...
1
vote
0answers
160 views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
1
vote
0answers
134 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
0
votes
0answers
21 views

Are there any known weaknesses in SignedXml by Microsoft for SAML?

SingedXml is a common way to verify the signature for SAML in .Net applications. I am wondering if it secure enough, i.e. there is no way to trick it (by making it verify not top-level Assertion or ...
0
votes
0answers
194 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...