2

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service provider will query the identity provider. Based on this link -- https://developers.onelogin.com/saml , the service provider identifies the identity provider based on "application subdomain, user IP address, or similar." My question is, what prevents the identity provider from acting maliciously and saying, "Sure, this user has access. Let them in!" I mean, I could just set up my own identity provider and if I'm identified by IP address, couldn't I just pretend that this user has access?

Improve this question

2 Answers 2

Reset to default
2

The identity provider selection would be from a list of trusted identity providers with which the service provider application has already exchanged certificates or configured known metadata URL.

So yes, you could set up your own identity provider, but it would have to be a very badly-written service provider application that would redirect to you and trust your SAML assertions if you were not already in their configured list or otherwise known to them (e.g. a Federation setup).

Improve this answer
2
  • Thanks. So perhaps a fairly obvious follow-up, but if a good service provider has a list on its side of potential identity providers, and your request does not originate from the IP address matching one of these identity providers, your request would (or should) just be rejected?
    – Dave
    May 16, 2019 at 15:16
  • 1
    rejected, but not by IP address. Rejected because the assertions are not signed with a certificate that you trust.
    – explunit
    May 16, 2019 at 20:33
0

No because the application is only configured to use the identity provider specified in the code the devs wrote.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .