A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes? Is this a correct answer or have I missed something?
Not signing a SAML-ticket would be a very bad idea because you would be an easy target for "Man in the middle-attack", Am I correct?
There is an in-depth analysis of the security of SAML in the PhD thesis of Thomas Gross (Bochum):
http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf
His analysis led to the revision 2.0 of the SAML standard. It is very clear that certain communications have to be encrypted to keep the protocol secure, and that you need to know that you communicate with the right server.
While there are other possible solutions than server certificates, certificates are the standard way to do it. Note that only the servers need to have certificates, it is not necessary that the users/browsers have certificates.
