We are using the nameId from the SAML response (in email format) to identify and authorize the incoming user on our system. Could a different authenticated user not alter the SAML response from their redirection to have a different known nameId. Authorizing themselves as a different user on our system?
Generally, no. The SAML response and/or the assertions contain a signature that would become invalid if the underlying XML (such as the value of the NameId attribute) were altered. The relying party verifies this signature prior to trusting the contents of the assertion.
Of course, software is software and there could be bugs at either end, e.g.
- The system that generates SAML (Identity Provider) could have a bug where it allows them to specify arbitrary usernames to be placed into the assertions before the signature is added.
- The receiving system (Relying Party) could have a bug where it fails to verify the signature. It should be noted that the signature can be found in multiple places in the SAML and there's a category of bugs that allow XML signature wrapping attacks to defeat the intended validation. It is not recommended to "roll your own" signature validation. Rather, depend on one of the well-tested implementations (commercial or open source) that exist for most platforms.
But these would be rather fundamental errors. The SAML specification itself is designed to protect against exactly the problem you describe. This is why you need to obtain the public key of your IDP (either via metadata or out of band) prior to receiving any SAML assertions. They sign with their private key and you verify with the public key associated.