Information Security

Questions tagged [saml]

Ask Question

An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

109 questions
Newest
Active
Bountied
Unanswered
Filter by
Sorted by
Tagged with
-4
votes
0answers
51 views

Differences between SAML and OpenID Connect

In OpenID, the client needs to support OpenID Identity provider and the client (application) needs to register with OpenID Identity provider. This is similar to the service provider in SAML ...
0
votes
0answers
50 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this, the ...
0
votes
0answers
48 views

Can I leverage Shibboleth to avoid recurring metadata exchanges with our customer?

we provide various web services for our customers, leveraging their IdP to have the customers' employees sign in with their company-issued accounts. Sometimes we operate web services for one customer ...
0
votes
1answer
70 views

Could SAML assertion/token be shared or reused between service providers?

SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) ...
2
votes
1answer
50 views

Why sign SAML authentication requests

In SAML, signing or encrypting the assertions seems to be essential, but I'm not finding much information describing any benefits or drawbacks of signing the authentication request in real world "...
2
votes
1answer
44 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
3
votes
2answers
247 views

HTTP Response to a SAMLResponse POST by user agent

Looking at RFC2616, is it acceptable to return an HTTP 200 (page load) as a response to a SAMLResponse post to the SP? i.e. the user-agent loads a page instead of redirecting via a 302 / 303? Looking ...
0
votes
1answer
87 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
3
votes
0answers
75 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
1
vote
0answers
79 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
1answer
76 views

If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?

I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
1
vote
2answers
104 views

Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?

I'm trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn't required. After authentication, if a service ...
2
votes
2answers
74 views

What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
0
votes
1answer
64 views

Shibboleth SP two resources and two IDPs

I am looking for some recommendation / advice, with the following scenario: Using apache 2.4 and Shib 2. The setup is SP initiated. Only one Apache web server I am protecting two resources. example....
1
vote
1answer
64 views

SAML Security Question

I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo. Acme users log in to App through an IdP-initiated flow. Foo users also log in to App ...
0
votes
0answers
39 views

SSO using SAML 2.0/OIDC

I have a scenario in mind and I am wondering if this is, in general, a drawback to SSO using SAML 2.0/OIDC or if there are any known ways to mitigate such a scenario: Background: 1. A user is able to ...
0
votes
0answers
333 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
40 views

Save SAML AuthnContextClassRef at login and use when signing?

I want to force reauthentication when a user signs a document using ForceAuthn and RequestedAuthnContext / AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a ...
2
votes
1answer
2k views

SAML assertion encryption and using same key for encryption as signing

I am working with a company that has product that supports SAML based authentication. We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
2
votes
1answer
807 views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
3
votes
0answers
38 views

SAML - when creating new users, how do I get essential fields?

My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO. I understand the SAML workflow for authentication, and roughly how we'd implement ...
0
votes
1answer
81 views

Fool SAML authentication

My company's has given a corporate membership to Udemy, which is accessible from company's laptop only. I tried to look into it and it uses SAML. If I open my company's Udemy website on any other ...
0
votes
1answer
173 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
1
vote
1answer
143 views

Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?

We are using SAML Web Browser SSO Profile (SAML 2.0) We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs. If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
1answer
129 views

Is Browser based flows required for most IdP based Authentication standards?

I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...
1
vote
0answers
38 views

GLUU support for SAML URI binding

I understand that GLUU uses Shibboleth for SAML. As going through the Shibboleth Protocols and interfaces, there doesn't seem to be any support for SAML URI binding. Does GLUU support URI binding? If ...
2
votes
0answers
48 views

Voting w/ SAML + BlockChain

There are a few grass roots initiatives to introduce blockchain as a ledger for election voting. My criticism of the ones I have seen, at the time I saw them, is that they did not adequately address ...
0
votes
1answer
180 views

How to setup SAML?

I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP. I am using "https://simplesamlphp.org/" For example, I have 3 websites "example.com", "...
2
votes
0answers
330 views

SAML 2 | Refresh IdP Session when user is working on SP

Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP. The use case is that after successful SP-Initiated SSO, there are two sessions in ...
5
votes
1answer
777 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
4
votes
0answers
319 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
1
vote
1answer
68 views

Are these SAML NameID's equivalent?

I have an application that uses SAML authentication, acts as an SP, and therefore parses SAMLResponses. I received notification that an IdP that communicates with my application will now start signing ...
0
votes
1answer
203 views

SAML nameID impersonation

We are using the nameId from the SAML response (in email format) to identify and authorize the incoming user on our system. Could a different authenticated user not alter the SAML response from their ...
1
vote
2answers
1k views

Where are passwords stored in SAML? On the IdP or on the SP side?

I understand the basic flow of SAML but is still unclear to me where the passwords are stored. This image shows "APP VERIFIES SAML RESPONSE & LOGS USER IN" from onelogin looks like the password ...
3
votes
1answer
96 views

Is there a way to tell if an Android app really uses SSO(Single Sign On)?

In the last few years, SSO protocols like OAuth and SAML are becoming increasingly used to enable 3rd parties access some user's resources from some service without the need for user to provide ...
1
vote
1answer
787 views

Can an SSL certificate be used to generate a SAML token

An external application (B) requires a SAML token to allow users who log into my application (A) to access it directly without having to log in again. This access is not built yet. My organization has ...
1
vote
0answers
421 views

Appropriate use of validUntil and cacheDuration in metadata

After reading the spec I'm unclear on the appropriate use of validUntil and cacheDuration in SAML metadata. Is there any danger in having a validUntil value a year or more into the future? For ...
1
vote
0answers
550 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
1
vote
0answers
26 views

is it possible to log un-encypted assertions in saml

Our system logs assertions before we encrypt them using PROTOCOL_MESSAGE, but for some SP's doesn't encryption and there is no logging. Is there a way to log SAML assertions even when we are not ...
1
vote
1answer
202 views

Any practical Single Sign-On (SSO) protocol/traffic analysis tool/method/analyzer? [closed]

I want to analyze the SSO protocol/traffic that is deployed in real environment, such as commercial website. The challenge is that most of them are black-box. Scenario 1. I read several papers about ...
0
votes
1answer
273 views

Storing SAML Idp certificates in APP_Data folder

We provided a SAML2 Service Provider to our client, so they can use that to configure their Identity Provider to our Service Provider. My questions is about our client certificate, I'm worried that ...
0
votes
1answer
124 views

Is it possible to analyze real Single Sign-On (SSO) messages via network sniffing?

I am thinking how to gain and analyze the information in the real SSO (request/response) messages, for some commercial SSO solutions. The challenge is that most commercial SSO solutions are black-box ...
2
votes
1answer
48 views

Verification methods of IDP in SAML2 IDP initiated login

What are the methods we can use to verify Identity Provider in Identity Provider initiated login in SAML2 Single sign on (SAML2 SSO)? Can any one who has access to IDP private key are able to create a ...
2
votes
1answer
1k views

Do we need CSRF protection for WS-Federation Passive Requestor Profile?

Consider the steps involved in WS-Federation Passive Requestor Profile1: The above figure shows a sequence diagram of a user (requestor) accessing a web application with his browser. Since the user ...
0
votes
1answer
41 views

Claims based authentication to log on to a device

Are there operating systems that allow logging on to the device (laptop, tablet etc.) using claims based authentication?
0
votes
1answer
149 views

What do I need to ask 3rd party to add trust

We have ADFS and want to add a 3rd party application as trusted to it. I have certificate and metadata (xml) URI to give them but want to have a checklist what they need to give me. So far HTTP ...
5
votes
3answers
8k views

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

The prevailing notion seems to be that OAuth2 and OpenID Connect are considered less secure than SAML/WS-Federation. From what I gather, it comes down to encryption - i.e. the fact that OAuth2/Open ID ...
4
votes
1answer
2k views

How does SAML signature exchange work between IDP and SP?

I'm trying to understand the SAML protocol 2.0 (signed) exchange. Here is what I understood so far: IDP has its own public (PB1) and private (PV1) pair SP has its own public (PB2) and private (PV2)...
5
votes
1answer
7k views

Self-signed certificate for a IdP-initiated SAML SSO

We act as a Service Provider in a SAML SSO integration with our customers. During the dev and stage testing, we usually exchange metadata files and SSO endpoints. When forming our metadata we use the ...
2
votes
1answer
288 views

Adfs saml credential provider

Wanted to see if the following is feasible or is there a way out? My situation, computers have internet access always (assumption) I want to write a credential provider with a browser embed and talk ...

1 2 3