Questions tagged [saml]

An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

Filter by
Sorted by
Tagged with
1 vote
0 answers
48 views

Risks with having a "localhost" service configured on a production SAML/OAuth/OIDC Identity Provider

To help developers with integrating with our SAML/OAuth/OIDC Identity Provider on their local dev environments, I'm thinking about configuring a demo client/app in our production IdP that has ...
xsrf's user avatar
  • 178
1 vote
2 answers
106 views

Verify user credentials via SAML (E-Signature)

I have a requirement to extend a quality assurance process in the customers CRM system so that when the user enters some data he or she is prompted to a screen with username and password and the ...
Jakub Zvonek's user avatar
1 vote
1 answer
122 views

How to delegate SAML2 authentication between Service Providers (SPs)?

We have an existing SP called S1 that authenticates to multiple Idps. We have another service called S2, I want S2 to delegate authentication to S1 then to Idp, then back and notify S2 when ...
Marconi's user avatar
  • 111
0 votes
0 answers
151 views

How to handle KB5025823 X509 changes correctly?

According this change here, .NET Core will handle imports of X509 certificates differently. Using .NET 6, for the value of System.Security.Cryptography.Pkcs12UnspecifiedPasswordIterationLimit, we ...
Francis Ducharme's user avatar
1 vote
0 answers
84 views

in Saml Federation, can one Idp serve as a facade for authentication against multiple "back end" IdP's

Question In Saml Federation, can one Idp serve as a front-end proxy for authentication against multiple "back end" IdP's Context our multi-tenant application suports SAML for Authentation ...
user331465's user avatar
0 votes
1 answer
602 views

SAML Authentication Across multiple Service providers

I am in the process of building an integration between 2 service providers (SP). I have setup my own Identity Provider, KeyCloak. What I am trying to achieve is as follows: A user signs into SP1 using ...
dingo's user avatar
  • 101
0 votes
1 answer
71 views

Is an empty `<OrganizationURL />` within a Federation Metadata XML file considered invalid?

I have an IdP who produces metadata federation XML files where the <OrganizationURL /> element is empty. See the example below: <Organization> <OrganizationName xml:lang="en&...
user1913559's user avatar
2 votes
1 answer
545 views

SAML AuthnRequest encryption

I would like to make sure that SAML login is secure. Company mandates to sign and encrypt SAML, and most of the assertions are encrypted and signed already, although I have received an answer from a ...
csikos.balint's user avatar
1 vote
0 answers
70 views

Is it possible to combine SAML 2.0 SSO with session login of QR Code

I was wondering if it is possible to combine SAML 2.0 SSO with QR Code scanning or fundamentally it is not possible? If a session exists in one device the user can scan it with her chell phone and ...
Michail Michailidis's user avatar
1 vote
1 answer
1k views

In a SAML Response what is the need to sign both things, the complete SAML Response and the SAML Assertion?

SAML Response + SAML Assertion are both signed individually while sending back the response. But the SAML Response contains the SAML Assertion. The latter is actually a subset of the former. Then what ...
Mugen's user avatar
  • 131
0 votes
1 answer
115 views

Couldn't an attacker alter a SAML Response data along with the signature and digest?

Based on my understanding, the way signatures are generated in a SAML response is like this: Pick the SAML Response (without the signature block) Use the Service Provider's public key to generate a ...
Mugen's user avatar
  • 131
1 vote
1 answer
2k views

How is it decided whether a SAML setup should use HTTP GET or POST?

I'm reading about SAML Authentication and I've come across 2 different mechanisms. But I'm not seeing any proper explanation anywhere of which flow is used when. If you're creating a SAML service ...
Mugen's user avatar
  • 131
0 votes
1 answer
152 views

How is the encryption and signing handled in case of an HTTP 302 redirect to IDP for a SAML authentication request?

When an SAML Authentication request is performed, let's say that the Service Provider uses an HTTP 302 redirect. The user agent is redirected to the IdP via a GET request. This URL is provided by the ...
Mugen's user avatar
  • 131
0 votes
1 answer
2k views

Can someone please clarify about how the SAML response is sent back from IdP to SP

Traditionally an SSO SAML request for the authentication works as follows: The user agent sends the request to the SP asking for some resource SP sends a SAML authentication request to IdP. This can ...
Mugen's user avatar
  • 131
0 votes
1 answer
105 views

IdP Personal/Signer Certificates

We are implementing SAML/OIDC-based SSO across our enterprise and wanted to get a feel for best practices when it comes to using Personal/Signer Certificates within our IdP. Historically we've ...
user1913559's user avatar
1 vote
1 answer
89 views

Security aspects in SAML2 using configuration with metadata URI

I have an app where I may choose to configure SAML2 login in the app with: Public cert of IdP IdP SAML2 login URL IdP entity ID I may also choose to, instead, provide an HTTPS metadata URL from ...
fast-reflexes's user avatar
0 votes
0 answers
313 views

Is it inappropriate at all for someone in my client organization to email their PEM file to me?

I have a SAML offering for my clients to access my cloud based application. Should I have a portal for them to upload their certificates or should I go the easy route and just have them e-mail them to ...
williamohara's user avatar
-1 votes
1 answer
124 views

Other than domain, what other attribute can SAML work with?

I am very new to SAML and currently doing research on whether SAML is the right solution for me. All the SAML examples that I can find work on the email domain. I wonder if it is possible to build a ...
Jake's user avatar
  • 487
1 vote
2 answers
418 views

Does it make sense to split two factor authentication between identity providers

A common multi factor authentication solution will ask a user for a username+password and a one-time password. In all documents I can find both factors are asked by the same identity provider. This ...
Jeff's user avatar
  • 3,609
1 vote
0 answers
204 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
nblackburn's user avatar
1 vote
2 answers
274 views

SAML and privacy: does the Identity Provider have to know about the Service Provider?

Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On? By looking at the specs, I see references to various elements that ...
Fabio A.'s user avatar
  • 113
1 vote
0 answers
520 views

SAML/oauth2/openid-connect login via proxy as another user

I manage a set of service providers (SP1, SP2, SP3, etc), and we currently have this SAML SSO flow working where the SP causes a POST submit to the SAML IDP with an XML SAML request which includes an ...
DavidG's user avatar
  • 111
0 votes
1 answer
299 views

How does one detect and deter golden SAML attacks?

How does one defend, detect and deter golden SAML attacks?
Nathan Aw's user avatar
11 votes
1 answer
546 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
O. Jones's user avatar
  • 379
9 votes
2 answers
4k views

Why is SAML still used for enterprise SSO instead of OIDC?

Im trying to wrap my head around the difference between SAML/OIDC/and OAuth Is the only reason SAML is the most popular choice for enterprise SSO that its been around much longer? Is it expected to ...
user1028270's user avatar
0 votes
1 answer
1k views

How an IDP sends SAML assertion to an SP?

I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible. First is ...
Ssaf's user avatar
  • 3
1 vote
1 answer
350 views

SSO SAML2: validating/verifying the SAMLResponse at the ACS

So it's unclear how much more security needs to happen at the ACS point. I can see that the IDP signs a signature that involves a certificate and private key. The SP can verify the signature with the ...
Luka's user avatar
  • 115
1 vote
2 answers
363 views

Verifying the security of SAML SSO

I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
eden881's user avatar
  • 237
1 vote
2 answers
2k views

How does encryption, certificates in an end to end SSO flow?

So, I know how public-private key encryption works. I understand how/why certificates are required. I understand how a SSO flow (IdP initiated) works. But, I do not understand how the three of them ...
Saturnian's user avatar
  • 111
1 vote
1 answer
449 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
Architect 's user avatar
3 votes
0 answers
4k views

How to decrypt encrypted SAML assertion using private RSA key?

Our system supports SAML2 and acts as service provider. Our customer uses ADFS as identity provider. Metadata has been exchanged and the connection works. Unfortunately our system complains about the ...
oschlueter's user avatar
0 votes
1 answer
262 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
Lone Learner's user avatar
0 votes
2 answers
1k views

Do SAML responses containing encrypted assertions provide protection against MiTM attacks?

A previously asked question touches on topics which are very similar to what I am having trouble understanding. In a web application I am testing, SAML SSO is brokered using Keycloak. The SAML ...
Charles's user avatar
2 votes
0 answers
186 views

Automating SAML login for service users? [closed]

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic ...
Bret's user avatar
  • 21
2 votes
2 answers
2k views

Should a SAML Assertion whose SessionNotOnOrAfter value is exactly the same value as its AuthnInstant be treated as having an invalid session?

I am receiving SOAP requests with SAML AuthnStatements whose SessionNotOnOrAfter timestamp is EXACTLY the same value as its AuthnInstant: <saml:AuthnStatement AuthnInstant="2020-04-22T21:...
Freiheit's user avatar
  • 277
0 votes
1 answer
123 views

Is this possible in SAML?

Scenario: Consider a huge and diverse federation of Identity (IDPs) and Service (SPs) providers. Since trust level is generally low, Identity providers are reluctant to give out any kind of personal ...
Sir Cornflakes's user avatar
0 votes
0 answers
156 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
wrschneider's user avatar
0 votes
0 answers
117 views

Security of a web app with AzureAD auth

The company I work for is about to publish a custom web app (hosted in AWS) that authenticates through AzureAD. That way, when someone goes to https://www.mywebap.com it is redirected to AzureAd and, ...
cimetheshine's user avatar
2 votes
2 answers
342 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
Cyassin's user avatar
  • 515
1 vote
0 answers
168 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
Joe's user avatar
  • 456
1 vote
0 answers
316 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this: the ...
cip123's user avatar
  • 11
0 votes
1 answer
841 views

Could SAML assertion/token be shared or reused between service providers?

SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) ...
James Lin's user avatar
  • 111
5 votes
1 answer
3k views

Why sign SAML authentication requests

In SAML, signing or encrypting the assertions seems to be essential, but I'm not finding much information describing any benefits or drawbacks of signing the authentication request in real world "...
AndOs's user avatar
  • 151
2 votes
1 answer
310 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
O. Jones's user avatar
  • 379
5 votes
2 answers
4k views

HTTP Response to a SAMLResponse POST by user agent

Looking at RFC2616, is it acceptable to return an HTTP 200 (page load) as a response to a SAMLResponse post to the SP? i.e. the user-agent loads a page instead of redirecting via a 302 / 303? Looking ...
Brett's user avatar
  • 153
0 votes
2 answers
1k views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
user3748242's user avatar
3 votes
0 answers
156 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
redcalx's user avatar
  • 133
1 vote
0 answers
540 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
brndng's user avatar
  • 11
1 vote
1 answer
147 views

If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?

I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
Dave's user avatar
  • 155
1 vote
2 answers
840 views

Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?

I'm trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn't required. After authentication, if a service ...
Dave's user avatar
  • 155