Questions tagged [saml]

An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

Filter by
Sorted by
Tagged with
0
votes
1answer
119 views

Could SAML assertion/token be shared or reused between service providers?

SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) ...
0
votes
1answer
50 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
1answer
96 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
2answers
142 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
1answer
285 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
8
votes
2answers
197 views

SAML 2.0 Multiple AuthnStatements

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
1
vote
1answer
808 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
0
votes
0answers
53 views

How to decrypt encrypted SAML assertion using private RSA key?

Our system supports SAML2 and acts as service provider. Our customer uses ADFS as identity provider. Metadata has been exchanged and the connection works. Unfortunately our system complains about the ...
4
votes
1answer
478 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
0
votes
2answers
69 views

Do SAML responses containing encrypted assertions provide protection against MiTM attacks?

A previously asked question touches on topics which are very similar to what I am having trouble understanding. In a web application I am testing, SAML SSO is brokered using Keycloak. The SAML ...
1
vote
1answer
86 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
1
vote
0answers
82 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this: the ...
2
votes
1answer
2k views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
1
vote
0answers
50 views

Automating SAML login for service users?

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic Auth and ...
2
votes
0answers
414 views

SAML 2 | Refresh IdP Session when user is working on SP

Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP. The use case is that after successful SP-Initiated SSO, there are two sessions in ...
2
votes
2answers
99 views

Should a SAML Assertion whose SessionNotOnOrAfter value is exactly the same value as its AuthnInstant be treated as having an invalid session?

I am receiving SOAP requests with SAML AuthnStatements whose SessionNotOnOrAfter timestamp is EXACTLY the same value as its AuthnInstant: <saml:AuthnStatement AuthnInstant="2020-04-22T21:11:41....
0
votes
1answer
55 views

Is this possible in SAML?

Scenario: Consider a huge and diverse federation of Identity (IDPs) and Service (SPs) providers. Since trust level is generally low, Identity providers are reluctant to give out any kind of personal ...
0
votes
0answers
24 views

SSO-logged in Web Application does not log the user out. R&D says session is active at IDP, hence this is an expected behaviour

Like the title says, one of our application uses SAML based authentication and uses Okta as the IDP. After logging in, I noticed that the session remains active for many hours even after I log out of ...
0
votes
0answers
48 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
57 views

Security of a web app with AzureAD auth

The company I work for is about to publish a custom web app (hosted in AWS) that authenticates through AzureAD. That way, when someone goes to https://www.mywebap.com it is redirected to AzureAd and, ...
1
vote
0answers
30 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
4
votes
2answers
1k views

Does SAML 2.0 define how to pass only username from SP to IDP?

I am looking at a use case where the service provider will need to capture the user id (not password) to identify the target IDP. In this case, the requirement is to send the user id (that is already ...
3
votes
1answer
3k views

SAML assertion encryption and using same key for encryption as signing

I am working with a company that has product that supports SAML based authentication. We do not facilitate for just in time federation and only accept the user identifier in assertion responses (the ...
0
votes
0answers
59 views

Can I leverage Shibboleth to avoid recurring metadata exchanges with our customer?

we provide various web services for our customers, leveraging their IdP to have the customers' employees sign in with their company-issued accounts. Sometimes we operate web services for one customer ...
8
votes
2answers
5k views

Definition of “passive” and “active” authentication?

I came across the concepts of passive authentication and active authentication in my work related to SAML 2.0 single-sign-on integration. I tried very hard to find a clear, generic definition and a ...
2
votes
1answer
100 views

Why sign SAML authentication requests

In SAML, signing or encrypting the assertions seems to be essential, but I'm not finding much information describing any benefits or drawbacks of signing the authentication request in real world "...
2
votes
1answer
54 views

why use a CA-signed key pair to encrypt SAML2 assertions?

I have a customer who insists upon using only certificate-authority signed key-pair certificates for encrypting SAML2 assertions. In this use case, I hold the private key in my Service Provider, and ...
15
votes
4answers
36k views

How is SAML solving the cross domain single sign-on problem?

Let's say I have two websites that live on separate domains, and their service providers both talk to the same identity provider on a third domain. I log into the first website and authenticate, and ...
3
votes
2answers
594 views

HTTP Response to a SAMLResponse POST by user agent

Looking at RFC2616, is it acceptable to return an HTTP 200 (page load) as a response to a SAMLResponse post to the SP? i.e. the user-agent loads a page instead of redirecting via a 302 / 303? Looking ...
0
votes
1answer
73 views

Shibboleth SP two resources and two IDPs

I am looking for some recommendation / advice, with the following scenario: Using apache 2.4 and Shib 2. The setup is SP initiated. Only one Apache web server I am protecting two resources. example....
3
votes
0answers
79 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
1
vote
0answers
164 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
1answer
83 views

If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?

I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
1
vote
2answers
177 views

Is there a SAML scenario where you would need an encrypted assertion if you are using SSL?

I'm trying to understand the benefits of encrypting assertions in SAML requests, especially if those requests travel over SSL. As I have read, this isn't required. After authentication, if a service ...
2
votes
2answers
80 views

What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
2
votes
2answers
249 views

OAuth & SAML integration or better approach

Could anyone explain what would be the best approach for this scenario?: There are 2 separate Service Providers: System A is a server that works as a rest API for a mobile application. System B is ...
1
vote
1answer
70 views

SAML Security Question

I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo. Acme users log in to App through an IdP-initiated flow. Foo users also log in to App ...
0
votes
0answers
568 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
2
votes
1answer
1k views

SHA1 signature in a SAML request

I'm currently looking at the security of a KeyCloak implementation, which again uses SAML 2.0 identity provider. I'm not too familiar with SAML, but during the authentication, the sent SAMLRequest ...
27
votes
1answer
19k views

What are the differences between JSON Web Tokens, SAML and OAuth 2?

What are the differences between JSON Web Tokens, SAML and OAuth 2. Please provide some pointers and high level overview of their functions. Specifically, why would one use SAML over JSON Web Tokens ...
1
vote
1answer
92 views

Fool SAML authentication

My company's has given a corporate membership to Udemy, which is accessible from company's laptop only. I tried to look into it and it uses SAML. If I open my company's Udemy website on any other ...
3
votes
0answers
41 views

SAML - when creating new users, how do I get essential fields?

My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO. I understand the SAML workflow for authentication, and roughly how we'd implement ...
1
vote
1answer
163 views

Is Browser based flows required for most IdP based Authentication standards?

I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...
1
vote
1answer
190 views

Is signature validation mandatory if encrypted assertions are sent over HTTPs in SAML 2.0?

We are using SAML Web Browser SSO Profile (SAML 2.0) We have a SP using SAML2.0. All communication between IdP and SP is over HTTPs. If AuthnResponse from IdP is sent over HTTPs, is it mandatory for ...
1
vote
0answers
39 views

GLUU support for SAML URI binding

I understand that GLUU uses Shibboleth for SAML. As going through the Shibboleth Protocols and interfaces, there doesn't seem to be any support for SAML URI binding. Does GLUU support URI binding? If ...
2
votes
0answers
54 views

Voting w/ SAML + BlockChain

There are a few grass roots initiatives to introduce blockchain as a ledger for election voting. My criticism of the ones I have seen, at the time I saw them, is that they did not adequately address ...
1
vote
1answer
231 views

How to setup SAML?

I am learning about SAML and already read many articles and forums but I still having confusion about setup IdP. I am using "https://simplesamlphp.org/" For example, I have 3 websites "example.com", "...
5
votes
3answers
9k views

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

The prevailing notion seems to be that OAuth2 and OpenID Connect are considered less secure than SAML/WS-Federation. From what I gather, it comes down to encryption - i.e. the fact that OAuth2/Open ID ...
5
votes
1answer
879 views

How to get better IAM understanding

I'm getting interested in Identity and Access Management (IAM), but I find it hard to find complete and understandable explanations that suit me, surely because I started wrong. I began with ...
5
votes
0answers
344 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...