3

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our software and can access private data of our clients. We have multiple clients and we use home realm discovery by domain to redirect users to the identity provider of our client. After the users have signed in we validate the domain against a list of allowed domains for that identity provider.

We have a new client (ClientX) which also has users using a @gmail.com account and they should be redirected to their identity provider to login. Of course we don't want every gmail user to be authenticated using ClientX's identity provider so we'll me making a page https://login.our-domain.com/ClientX for that client to be automatically redirected to their identity provider. But we are unsure how many domains they can have, should we just blindly trust everything their identity provider says? When we trust all domains that also means someone could pretend to be someone else. For example the identity provider can pretend to be @our-domain.com. It is a well respected client but I think we are to blame if their security fails.

Rights are given a head of time to known users. So unknown users don't have any rights but the security risk lies in ClientX saying that a user is another known user in our system. Also, rights are based on e-mail address so that we cannot uniquely identity a user with a specific identity provider.

Couple of options we thought of:

  1. Have a fixed list of users ClientX can authenticate.
  2. Have a fixed list of domains ClientX can authenticate.
  3. Change our rights system to use an identifier instead of e-mail address so that we can identity a person with an identity provider.
  4. Just trust the client and their security system.
  5. Other suggestions?

So I'm looking for advice on this. Seems a common enough question but I could not find anything on this. How much do you trust other identity providers? Any advice is very appreciated!

1

Never use the IdP-provided identifier alone; use it together with the IdP's own name. (For example, in SAML2 each IdP has its own entity ID, and I believe it's common practice to combine it with the username somehow.) So you would recognize these as two distinct users:

ClientX,user@example.com
ClientY,user@example.com

It doesn't matter much what type of identifier you use exactly (email or username or SID or GUID) – as long as it's just a text string that's 100% IdP-provided, it won't be enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.