1

I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo.

Acme users log in to App through an IdP-initiated flow. Foo users also log in to App through an IdP-initiated flow. Accounts in App are identified by email address, say [email protected] and [email protected].

A bad actor at Acme decides to create an account in their IdP identified by [email protected]. Then the bad actor tries to sign in to App with that account (an account called "[email protected]" that lives in Acme's IdP). How do I prevent that?

In other words, I want the trust relationship between App and Acme to be limited only to accounts @acme.com, and the trust relationship between App and Foo to be limited only to accounts @foo.com.

In other other words, if Acme's IdP tries to authenticate a user that "belongs" to Foo's IdP, then I don't want to authenticate that user.

1 Answer 1

2

Each SAML response includes an issuer field identifying the IdP. Furthermore, either the SAML response or assertion is signed by the IdP's private key so, as long as the signature verifies, you know who sent the SAML response.

If your SP receives a SAML response from Acme it should make the additional check that it includes an @acme.com email address.

In general, the SP can reject the SAML response if it doesn't contain the user identity information it requires or this information is invalid from its perspective.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .