1

I've implemented SAML 2.0 using the ruby-saml gem in my Rails app. In this app, clients can specify their SAML idp for their account. I have a client who insists that requiring HTTPS for the Issuer URL does nothing for security. I figured this URL represents their identity provider. Because of that I figured allowing HTTP identity providers might open my app up to MITM attacks, via their app.

Is it safe to allow HTTP URLs for Issuer URLs for SAML 2.0 implementations? If so, I'd like to hear why.

Improve this question
2
  • Maybe this wil help you stackoverflow.com/a/33297493/1788516
    – Perry
    Jul 29, 2016 at 22:14
  • The identity provider should be on HTTPs for sure, but the Issuer URL merely serves XML metadata about the SAML assertion. It's publically accessible and the protocol it's served on is therefore inconsequential. Okta and ADFS routinely host the issuer URL on a completely separate domain, which may or may not have HTTPS. I'll answer this when I can.
    – Archonic
    Jul 29, 2016 at 22:45

2 Answers 2

Reset to default
1

I believe that technically, HTTP for the issuer URL is OK as the data being transmitted is less sensitive. However, I would also argue that making it HTTPS is also fine. In the past, there was a belief that you should only use HTTPS where you absolutely needed to because of the additional overheads involved and potential performance hits. With the increase in speeds and processing power, this argument is no longer as valid (though there are still many sites with an architecture which relies heavily on caching for performance where HTTPS can have an adverse overall impact).

I tend to feel that complexity is now one of our main threats. Having an application which uses HTTP in some contexts and HTTPS in others adds to this complexity and makes verification more difficult. Much easier to monitor and varify everything is OK if all you need to do is ensure all connections are HTTPS rather than also having to check all non-HTTPS connections are OK.

Improve this answer
1

It is in fact safe to use HTTP for the Issuer URL. There is no exchange of sensitive information between a service provider and identity provider on the Issuer URL, therefore the protocol for that value can be ambiguous. The other URLs which represent the URL of identity provider should absolutely be on HTTPS, otherwise you would be exposing your service to identity providers which are vulnerable to MITM attacks.

The Issuer URL merely serves an XML file with metadata about your SAML implementation. It's not uncommon to see HTTPS URLs for the Issuer URL, since it's typically hosted on the same domain as the identity provider. This is not always the case though. Okta and ADFS are two services which host the metadata XML on a separate domain, which may not have HTTPS.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .