I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0.

In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to Service Provider.

What I don't fully understand is how are these tokens secured so nobody can steal it and use it from different device in order to get authenticated session and impersonate.

Also, how are these tokens stored? Are they stored as a cookie in a browser? If so, would it be possible to steal a token cookie and use it to impersonate somebody?

How can I detect that the token is used in an unauthorised manner?

I am looking for a practical view how are tokens secured and represented when authentication is established or when using as SSO, so authentication is not required by Identity Provider.


The tokens are secured at multiple level

  1. Transport - Most of the specs recommend SSL (and some mandate it)
  2. Use once - These token are just meant to transfer identity once and then the asserted identity can be attached with local session for further processing. Most of the specs contain safeguards to allow IdP & SP to track the generation and use of token only once.
  3. IdP Trust - The IdP & SP trust mechanism is built in to ensure that only trusted Identity Provider can set an identity at service provider through the protocol.

The checks for MIM and other attacks are built in to each protocol and you can read the RFC/Specs for each of the protocol to see how they stop those attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.