I've implemented SAML 2.0 using the ruby-saml gem in my Rails app. In this app, clients can specify their SAML idp for their account. I have a client who insists that requiring HTTPS for the Issuer URL does nothing for security. I figured this URL represents their identity provider. Because of that I figured allowing HTTP identity providers might open my app up to MITM attacks, via their app.
Is it safe to allow HTTP URLs for Issuer URLs for SAML 2.0 implementations? If so, I'd like to hear why.
I believe that technically, HTTP for the issuer URL is OK as the data being
transmitted is less sensitive. However, I would also argue that making it HTTPS
is also fine. In the past, there was a belief that you should only use HTTPS
where you absolutely needed to because of the additional overheads involved and
potential performance hits. With the increase in speeds and processing power,
this argument is no longer as valid (though there are still many sites with an
architecture which relies heavily on caching for performance where HTTPS can
have an adverse overall impact).
I tend to feel that complexity is now one of our main threats. Having an
application which uses HTTP in some contexts and HTTPS in others adds to this
complexity and makes verification more difficult. Much easier to monitor and
varify everything is OK if all you need to do is ensure all connections are
HTTPS rather than also having to check all non-HTTPS connections are OK.
It is in fact safe to use HTTP for the Issuer URL. There is no exchange of sensitive information between a service provider and identity provider on the Issuer URL, therefore the protocol for that value can be ambiguous. The other URLs which represent the URL of identity provider should absolutely be on HTTPS, otherwise you would be exposing your service to identity providers which are vulnerable to MITM attacks.
The Issuer URL merely serves an XML file with metadata about your SAML implementation. It's not uncommon to see HTTPS URLs for the Issuer URL, since it's typically hosted on the same domain as the identity provider. This is not always the case though. Okta and ADFS are two services which host the metadata XML on a separate domain, which may not have HTTPS.