Questions tagged [saml]
An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.
130
questions
0
votes
0answers
38 views
SSO, SAML and LDAP question
I have an application that uses SSO and needs to contact an LDAP server to retrieve whether the user exists or not. For that, I thought to use SAML as a means to link the SSO token user information ...
1
vote
0answers
21 views
SSO - SAMLResponse security via localhost reply [duplicate]
We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
1
vote
2answers
66 views
SAML and privacy: does the Identity Provider have to know about the Service Provider?
Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On?
By looking at the specs, I see references to various elements that ...
1
vote
0answers
59 views
SAML/oauth2/openid-connect login via proxy as another user
I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
0
votes
0answers
31 views
Secure Mobile Deeplink login with SAML (Android, iOS)
We want to use deeplink with a schema to login using SAML in our Mobile Apps:
i.e
ourschema://host?code=12345
The problem is that other apps on iOS can read the content of ourschema:// including the ...
0
votes
1answer
92 views
How does one detect and deter golden SAML attacks?
How does one defend, detect and deter golden SAML attacks?
9
votes
0answers
312 views
SolarWinds Orion SAML compromise mass cert update
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
0
votes
0answers
229 views
SAML-Authentication with angular, node.js and an identity provider
I want to to implement SSO using SAML2.
But I don't know how to get it work with a distributed system where each instance is running independently on its own server. The environment consists out of ...
1
vote
1answer
180 views
Why is SAML still used for enterprise SSO instead of OIDC?
Im trying to wrap my head around the difference between SAML/OIDC/and OAuth
Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...
0
votes
1answer
92 views
How an IDP sends SAML assertion to an SP?
I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is ...
1
vote
1answer
63 views
SSO SAML2: validating/verifying the SAMLResponse at the ACS
So it's unclear how much more security needs to happen at the ACS point.
I can see that the IDP signs a signature that involves a certificate and private key.
The SP can verify the signature with the ...
0
votes
0answers
60 views
OAuth 2.0: programmatically authenticate Resource Server user after Authorization Code grant
The requirement: have a user, existing in an IDP, be automatically authenticated on a Resource server. IDP app can then provide web view for resource server user.
OAuth 2.0 Approach:
IDP nudges ...
1
vote
1answer
54 views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
0
votes
2answers
125 views
How does encryption, certificates in an end to end SSO flow?
So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
0
votes
1answer
71 views
OAuth2, SAML, OpenID connect - Which one to use for my scenario?
I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
0answers
708 views
How to decrypt encrypted SAML assertion using private RSA key?
Our system supports SAML2 and acts as service provider. Our customer uses ADFS as identity provider. Metadata has been exchanged and the connection works. Unfortunately our system complains about the ...
0
votes
1answer
113 views
App-to-app or service-to-service authentication using federated login
I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS.
When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
2answers
164 views
Do SAML responses containing encrypted assertions provide protection against MiTM attacks?
A previously asked question touches on topics which are very similar to what I am having trouble understanding.
In a web application I am testing, SAML SSO is brokered using Keycloak. The SAML ...
1
vote
0answers
53 views
Automating SAML login for service users?
Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction?
I have a service provider that's SAML protected. Basic Auth and ...
2
votes
2answers
297 views
Should a SAML Assertion whose SessionNotOnOrAfter value is exactly the same value as its AuthnInstant be treated as having an invalid session?
I am receiving SOAP requests with SAML AuthnStatements whose SessionNotOnOrAfter timestamp is EXACTLY the same value as its AuthnInstant:
<saml:AuthnStatement AuthnInstant="2020-04-22T21:11:41....
0
votes
1answer
56 views
Is this possible in SAML?
Scenario: Consider a huge and diverse federation of Identity (IDPs) and Service (SPs) providers. Since trust level is generally low, Identity providers are reluctant to give out any kind of personal ...
0
votes
0answers
54 views
SAML and Multi-factor auth
I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP.
If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
57 views
Security of a web app with AzureAD auth
The company I work for is about to publish a custom web app (hosted in AWS) that authenticates through AzureAD.
That way, when someone goes to https://www.mywebap.com it is redirected to AzureAd and, ...
2
votes
2answers
116 views
SSO SP Initiated Single Sign Out - User Experience
I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD.
Now non technical savvy users understandably presume that logging off from our ...
1
vote
0answers
39 views
SSO and browser vs. server
We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks.
Our SAML ...
1
vote
0answers
96 views
SAML Passing a JWT token from the API to the SPA application
We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application.
The authentication flow goes like this: the ...
0
votes
1answer
181 views
Could SAML assertion/token be shared or reused between service providers?
SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) ...
2
votes
1answer
250 views
Why sign SAML authentication requests
In SAML, signing or encrypting the assertions seems to be essential, but I'm not finding much information describing any benefits or drawbacks of signing the authentication request in real world "...
2
votes
1answer
65 views
why use a CA-signed key pair to encrypt SAML2 assertions?
I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions.
In this use case, I hold the private key in my Service Provider, and ...
3
votes
2answers
934 views
HTTP Response to a SAMLResponse POST by user agent
Looking at RFC2616, is it acceptable to return an HTTP 200 (page load) as a response to a SAMLResponse post to the SP? i.e. the user-agent loads a page instead of redirecting via a 302 / 303?
Looking ...
0
votes
2answers
212 views
SSO Log Users Out Based on IP Address
We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
3
votes
0answers
81 views
Are the default Azure AD Authentication Certificates global?
When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
1
vote
0answers
234 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
1answer
85 views
If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?
I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
1
vote
2answers
221 views
Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?
I'm trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn't required. After authentication, if a service ...
2
votes
2answers
83 views
What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?
I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
0
votes
1answer
77 views
Shibboleth SP two resources and two IDPs
I am looking for some recommendation / advice, with the following scenario:
Using apache 2.4 and Shib 2.
The setup is SP initiated.
Only one Apache web server
I am protecting two resources.
example....
1
vote
1answer
70 views
SAML Security Question
I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo.
Acme users log in to App through an IdP-initiated flow. Foo users also log in to App ...
0
votes
0answers
769 views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
4
votes
1answer
4k views
SAML assertion encryption and using same key for encryption as signing
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
2
votes
1answer
2k views
SHA1 signature in a SAML request
I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
3
votes
0answers
42 views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
1
vote
1answer
95 views
Fool SAML authentication
My company's has given a corporate membership to Udemy, which is accessible from company's laptop only.
I tried to look into it and it uses SAML. If I open my company's Udemy website on any other ...
0
votes
1answer
349 views
Attack vectors with encrypted SAML assertion response
I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
1
vote
1answer
225 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
1answer
181 views
Is Browser based flows required for most IdP based Authentication standards?
I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...
1
vote
0answers
40 views
GLUU support for SAML URI binding
I understand that GLUU uses Shibboleth for SAML. As going through the Shibboleth Protocols and interfaces, there doesn't seem to be any support for SAML URI binding.
Does GLUU support URI binding? If ...
2
votes
0answers
66 views
Voting w/ SAML + BlockChain
There are a few grass roots initiatives to introduce blockchain as a ledger for election voting. My criticism of the ones I have seen, at the time I saw them, is that they did not adequately address ...
1
vote
1answer
252 views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
3
votes
0answers
471 views
SAML 2 | Refresh IdP Session when user is working on SP
Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP.
The use case is that after successful SP-Initiated SSO, there are two sessions in ...
