Questions tagged [saml]
An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.
0
votes
0answers
16 views
Save SAML AuthnContextClassRef at login and use when signing?
I want to force reauthentication when a user signs a document using ForceAuthn and RequestedAuthnContext / AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a ...
1
vote
1answer
35 views
SAML assertion encryption and using same key for encryption as signing
I am working with a company that has product that supports SAML based authentication.
We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
2
votes
1answer
41 views
SHA1 signature in a SAML request
I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider.
I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
3
votes
0answers
30 views
SAML - when creating new users, how do I get essential fields?
My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO.
I understand the SAML workflow for authentication, and roughly how we'd implement ...
0
votes
1answer
56 views
Fool SAML authentication
My company's has given a corporate membership to Udemy, which is accessible from company's laptop only.
I tried to look into it and it uses SAML. If I open my company's Udemy website on any other ...
0
votes
1answer
36 views
Attack vectors with encrypted SAML assertion response
I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
1
vote
1answer
51 views
Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?
We are using SAML Web Browser SSO Profile (SAML 2.0)
We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs.
If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
1answer
46 views
Is Browser based flows required for most IdP based Authentication standards?
I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...
0
votes
0answers
13 views
Can API Consumer be SAML token provider?
I am a newbie to SAML based authentication. In a typical B2B enterprise setup, I need to consume an API provided by another organization. API provider has two factor authentication enabled, mutual TLS ...
1
vote
0answers
21 views
GLUU support for SAML URI binding
I understand that GLUU uses Shibboleth for SAML. As going through the Shibboleth Protocols and interfaces, there doesn't seem to be any support for SAML URI binding.
Does GLUU support URI binding? If ...
2
votes
0answers
38 views
Voting w/ SAML + BlockChain
There are a few grass roots initiatives to introduce blockchain as a ledger for election voting. My criticism of the ones I have seen, at the time I saw them, is that they did not adequately address ...
0
votes
1answer
61 views
How to setup SAML?
I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP.
I am using "https://simplesamlphp.org/"
For example, I have 3 websites "example.com", "...
1
vote
0answers
199 views
SAML 2 | Refresh IdP Session when user is working on SP
Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP.
The use case is that after successful SP-Initiated SSO, there are two sessions in ...
4
votes
1answer
371 views
How to get better IAM understanding
I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong.
I began with ...
-1
votes
0answers
45 views
How to do authentication of SaaS implementation for uploading, processing, and retrieving documents
We would like to provide a B2B SaaS with the following flow:
Our customer's end-users upload their document using our custom
upload UI which should be embedded using an iframe
Once the user finishes ...
3
votes
0answers
227 views
Do I need to use SAML and JWT for auth in SSO web app?
I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
1
vote
1answer
47 views
Are these SAML NameID's equivalent?
I have an application that uses SAML authentication, acts as an SP, and therefore parses SAMLResponses. I received notification that an IdP that communicates with my application will now start signing ...
0
votes
1answer
135 views
SAML nameID impersonation
We are using the nameId from the SAML response (in email format) to identify and authorize the incoming user on our system.
Could a different authenticated user not alter the SAML response from their ...
1
vote
2answers
722 views
Where are passwords stored in SAML? On the IdP or on the SP side?
I understand the basic flow of SAML but is still unclear to me where the passwords are stored.
This image shows "APP VERIFIES SAML RESPONSE & LOGS USER IN" from onelogin looks like the password ...
3
votes
1answer
94 views
Is there a way to tell if an Android app really uses SSO(Single Sign On)?
In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
1
vote
1answer
592 views
Can an SSL certificate be used to generate a SAML token
An external application (B) requires a SAML token to allow users who log into my application (A) to access it directly without having to log in again. This access is not built yet. My organization has ...
1
vote
0answers
290 views
Appropriate use of validUntil and cacheDuration in metadata
After reading the spec I'm unclear on the appropriate use of validUntil and cacheDuration in SAML metadata. Is there any danger in having a validUntil value a year or more into the future?
For ...
1
vote
0answers
456 views
SSO - Client Certificate vs SAML
For me SSO is sign on where one need not type the password explicitly.
I see one of the possible way to achieve it is by using Certificates loaded in browser.
SAML/OAuth delegates the job of ...
1
vote
0answers
25 views
is it possible to log un-encypted assertions in saml
Our system logs assertions before we encrypt them using PROTOCOL_MESSAGE, but for some SP's doesn't encryption and there is no logging. Is there a way to log SAML assertions even when we are not ...
1
vote
1answer
181 views
Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]
I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box.
Scenario 1. I read several papers about ...
0
votes
1answer
186 views
Storing SAML Idp certificates in APP_Data folder
We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider.
My questions is about our client certificate, I'm worried that ...
0
votes
1answer
96 views
Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?
I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions.
The challenge is that most commercial SSO solutions are black-box ...
2
votes
1answer
46 views
Verification methods of IDP in SAML2 IDP initiated login
What are the methods we can use to verify Identity Provider in Identity Provider initiated login in SAML2 Single sign on (SAML2 SSO)? Can any one who has access to IDP private key are able to create a ...
2
votes
1answer
933 views
Do we need CSRF protection for WS-Federation Passive Requestor Profile?
Consider the steps involved in WS-Federation Passive Requestor Profile1:
The above figure shows a sequence diagram of a user (requestor) accessing a web application with his browser. Since the user ...
0
votes
1answer
40 views
Claims based authentication to log on to a device
Are there operating systems that allow logging on to the device (laptop, tablet etc.) using claims based authentication?
0
votes
1answer
123 views
What do I need to ask 3rd party to add trust
We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far
HTTP ...
3
votes
3answers
7k views
Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?
The prevailing notion seems to be that OAuth2 and OpenID Connect are considered less secure than SAML/WS-Federation. From what I gather, it comes down to encryption - i.e. the fact that OAuth2/Open ID ...
3
votes
1answer
913 views
How does SAML signature exchange work between IDP and SP?
I'm trying to understand the SAML protocol 2.0 (signed) exchange.
Here is what I understood so far:
IDP has its own public (PB1) and private (PV1) pair
SP has its own public (PB2) and private (PV2)...
5
votes
1answer
4k views
Self-signed certificate for a IdP-initiated SAML SSO
We act as a Service Provider in a SAML SSO integration with our customers. During the dev and stage testing, we usually exchange metadata files and SSO endpoints.
When forming our metadata we use the ...
2
votes
1answer
211 views
Adfs saml credential provider
Wanted to see if the following is feasible or is there a way out?
My situation, computers have internet access always (assumption)
I want to write a credential provider with a browser embed and talk ...
1
vote
0answers
191 views
Logout from IdP, where should user end up?
When a user clicks Logoff on my website, it executes the following .NET code:
public ActionResult SLOService()
{
// Receive the single logout request or response.
// If a request is received ...
1
vote
1answer
1k views
Is SSO without SSL possible and/or secure?
Lets imagine a site where HTTPS is not used, for any good or bad reasons. The admin of this site still need a way to secure connections and think about using unique authentication with social networks ...
1
vote
2answers
851 views
Is it safe to allow HTTP for SAML 2.0 Issuer URL?
I've implemented SAML 2.0 using the ruby-saml gem in my Rails app. In this app, clients can specify their SAML idp for their account. I have a client who insists that requiring HTTPS for the Issuer ...
1
vote
0answers
52 views
Does WS-Security require an extra signature in the SAML assertion?
According to the SAML core 2.0 profile, the signature, if there is one, should be right after the Issuer element (see section 2.3.3). But in the WS-Security 1.1.1 profile, the example at section 3.5....
5
votes
2answers
684 views
Does SAML 2.0 define how to pass only username from SP to IDP?
I am looking at a use case where the service provider will need to capture the user id (not password) to identify the target IDP. In this case, the requirement is to send the user id (that is already ...
4
votes
1answer
6k views
Does SAML 2.0 define how to pass username and password for authentication?
I'm aware of how SAML is used for single sign on (SSO). That is, redirection to IDP from SP and getting the user's identity from the SAML response/assertion.
My question is: Does SAML 2.0 ...
6
votes
4answers
953 views
Authentication Middleware
We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
0
votes
1answer
857 views
How can I test my SSO connection without having access to the Identity Provider?
I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP).
I don't have access to an ...
1
vote
0answers
588 views
SAML, OAUTH, XACML oh my (Authorization)!
Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can:
Given multiple ...
4
votes
1answer
442 views
SAML token and service calls
I am working on a tablet application and have come across an interesting issue.
We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
1
vote
0answers
308 views
Different timezone in WebSSO using ADFS as IDP
Is there a best practise when it comes to handling timezones in an international single-sign-on solution?
I've been asked to include the clients timezone in our saml-ticket as an attribute. This will ...
3
votes
1answer
1k views
Automated SAML authentication without user interaction
I'm required to integrate my website with SAML authentication, so that any login done to my website, the credentials will be validated by a specific idp (known in advance)
Even after reading many ...
2
votes
0answers
1k views
Securing a JavaScript Single Page App with SAML
I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options?
Details: I have worked with OAuth2 in the past, but I ...
2
votes
1answer
840 views
SAML without certificate
A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes?
Is this a ...
7
votes
1answer
2k views
Definition of “passive” and “active” authentication?
I came across the concepts of passive authentication and active authentication in my work related to SAML 2.0 single-sign-on integration. I tried very hard to find a clear, generic definition and a ...
