2

I would like to make sure that SAML login is secure. Company mandates to sign and encrypt SAML, and most of the assertions are encrypted and signed already, although I have received an answer from a well known auth provider, when I asked about AuthnRequest encryption (federated).

After discussing it with our team and doing extensive research, we couldn't find any functional way to encrypt the SAML Authentication Request. We can encrypt the response when we are the IDP, but it doesn't appear that encrypting the Request is something we support. Can I ask, what information in the request are you hoping to encrypt? Most of the details in an AuthN request need to be accessible in the browser to allow for the exchange to occur.

After the reply, I have some doubts. My question: Does it make sense to encrypt AuthnRequests?

1 Answer 1

4

No. The SAML specification doesn't include support for encrypting authn requests. There isn't any user or sensitive information included in authn requests so there's no requirement for privacy. Of course, there is privacy at the transport layer as you should be using HTTPS.

Sometimes people confuse encryption with signatures. Signing the authn request is supported by the SAML specification and it makes sense to do so in some scenarios. This ensures the integrity of the message.

Also, the comment "Most of the details in an AuthN request need to be accessible in the browser to allow for the exchange to occur" is misleading. The browser supports the sending of the authn request from the service provider to the identity provider but it does not access or understand the authn request contents.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .