1

We are using SAML Web Browser SSO Profile (SAML 2.0)

We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.

If AuthnResponse from IdP is sent over HTTPs, is it mandatory for the SP to validate the signature on both the encrypted assertions and the signature on the entire response? Is the IdP not required to do signature validation if the all the assertions are encrypted?

Thanks.

Improve this question

1 Answer 1

Reset to default
2

Unless you are using Artifact binding (not very common), signature validation is always required. While the communication with both the SP and the IDP is via HTTPS, the user's web browser is relaying the responses/assertions, so you cannot trust the integrity of those messages. Thus the use of signing.

Encryption, on the other hand, might be a duplication of what HTTPS provides, depending on the structure of how the IDP is generating/receiving those assertion. But keep in mind that decrypting a message does not prove its integrity.

Summary: you might be able to drop the encryption but you cannot drop the signing.

Improve this answer
2
  • Is signature validation on the entire response sufficient rather than validating each assertion?
    – user674669
    Oct 8, 2018 at 17:39
  • 1
    Normally either the SAML response or the SAML assertion is signed by the IdP. It's less common for both to be signed. Therefore, whichever is signed is what you should verify. You don't get a choice. Of course, the SAML response signature covers the embedded SAML assertion(s) as well so if the SAML response signature verifies you know that the integrity of the SAML response and its SAML assertion(s) hasn't been compromised.
    – ComponentSpace
    Oct 8, 2018 at 22:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .