1

I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo.

Acme users log in to App through an IdP-initiated flow. Foo users also log in to App through an IdP-initiated flow. Accounts in App are identified by email address, say jdoe@acme.com and rsmith@foo.com.

A bad actor at Acme decides to create an account in their IdP identified by rsmith@foo.com. Then the bad actor tries to sign in to App with that account (an account called "rsmith@foo.com" that lives in Acme's IdP). How do I prevent that?

In other words, I want the trust relationship between App and Acme to be limited only to accounts @acme.com, and the trust relationship between App and Foo to be limited only to accounts @foo.com.

In other other words, if Acme's IdP tries to authenticate a user that "belongs" to Foo's IdP, then I don't want to authenticate that user.

2

Each SAML response includes an issuer field identifying the IdP. Furthermore, either the SAML response or assertion is signed by the IdP's private key so, as long as the signature verifies, you know who sent the SAML response.

If your SP receives a SAML response from Acme it should make the additional check that it includes an @acme.com email address.

In general, the SP can reject the SAML response if it doesn't contain the user identity information it requires or this information is invalid from its perspective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.