New answers tagged saml
To expand on Stefan's answer: I would also ensure that the certificate used for signing is different than the one used for encryption, as well as different from the one the TLS (I hope you aren't still using SSL) is using to secure the communications channel. In other words... A unique certificate for each thing.
It is not specified that the certificates for two idps must be unique. As far as I know you dont even have to have a certificate. But its recommended.
It is explained in Security and Privacy Considerations for the OASIS Security Assertion Markup Language (SAML) V2.0 section 6.1.3 Message Insertion. It is primarily a method for blocking fabricated requests inserted into the communication. As a complement to signing and/or SSL. It is not solving a separate security issue but is an in depth defense. My ...
As Guido points out in his comment, it largely depends on the target system. If the target system has clearly defined APIs / interfaces you can protect, then XACML would make more sense (XACML has an architecture whereby a policy enforcement point intercepts a flow and sends off an authorization request to a policy decision point). If, on the other hand, ...
Top 50 recent answers are included