Questions tagged [saml]

An open Single Sign On (SSO) solution for the web, a problem also addressed by OpenID.

36 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
2answers
197 views

SAML 2.0 Multiple AuthnStatements

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.
5
votes
0answers
344 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
4
votes
1answer
478 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
3
votes
0answers
79 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
3
votes
0answers
41 views

SAML - when creating new users, how do I get essential fields?

My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO. I understand the SAML workflow for authentication, and roughly how we'd implement ...
3
votes
0answers
960 views

Can a service provider communicate directly with an identity provider?

I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity ...
2
votes
0answers
54 views

Voting w/ SAML + BlockChain

There are a few grass roots initiatives to introduce blockchain as a ledger for election voting. My criticism of the ones I have seen, at the time I saw them, is that they did not adequately address ...
2
votes
0answers
413 views

SAML 2 | Refresh IdP Session when user is working on SP

Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP. The use case is that after successful SP-Initiated SSO, there are two sessions in ...
2
votes
1answer
2k views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
1
vote
0answers
50 views

Automating SAML login for service users?

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic Auth and ...
1
vote
1answer
85 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
1
vote
0answers
30 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
1
vote
0answers
82 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this: the ...
1
vote
0answers
164 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
0answers
39 views

GLUU support for SAML URI binding

I understand that GLUU uses Shibboleth for SAML. As going through the Shibboleth Protocols and interfaces, there doesn't seem to be any support for SAML URI binding. Does GLUU support URI binding? If ...
1
vote
0answers
446 views

Appropriate use of validUntil and cacheDuration in metadata

After reading the spec I'm unclear on the appropriate use of validUntil and cacheDuration in SAML metadata. Is there any danger in having a validUntil value a year or more into the future? For ...
1
vote
0answers
567 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
1
vote
0answers
28 views

is it possible to log un-encypted assertions in saml

Our system logs assertions before we encrypt them using PROTOCOL_MESSAGE, but for some SP's doesn't encryption and there is no logging. Is there a way to log SAML assertions even when we are not ...
1
vote
0answers
234 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
1
vote
0answers
58 views

Does WS-Security require an extra signature in the SAML assertion?

According to the SAML core 2.0 profile, the signature, if there is one, should be right after the Issuer element (see section 2.3.3). But in the WS-Security 1.1.1 profile, the example at section 3.5....
1
vote
0answers
634 views

SAML, OAUTH, XACML oh my (Authorization)!

Unfortunately, after using several SSO/IAM products at a 'lite touch' to 'deep integration' level, I'm still left unsatisfied, so going to ask the most basic question I can: Given multiple ...
1
vote
0answers
419 views

Different timezone in WebSSO using ADFS as IDP

Is there a best practise when it comes to handling timezones in an international single-sign-on solution? I've been asked to include the clients timezone in our saml-ticket as an attribute. This will ...
1
vote
1answer
808 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
0
votes
1answer
46 views

OAuth2, SAML, OpenID connect - Which one to use for my scenario?

I work for a company where we give customer (hundreds/thousands of users) access to 2 sites. One owned by a 3rd party SaaS and one owned by us. Customers spend alot of time registering for both sites ...
0
votes
0answers
52 views

How to decrypt encrypted SAML assertion using private RSA key?

Our system supports SAML2 and acts as service provider. Our customer uses ADFS as identity provider. Metadata has been exchanged and the connection works. Unfortunately our system complains about the ...
0
votes
1answer
92 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
2answers
68 views

Do SAML responses containing encrypted assertions provide protection against MiTM attacks?

A previously asked question touches on topics which are very similar to what I am having trouble understanding. In a web application I am testing, SAML SSO is brokered using Keycloak. The SAML ...
0
votes
0answers
24 views

SSO-logged in Web Application does not log the user out. R&D says session is active at IDP, hence this is an expected behaviour

Like the title says, one of our application uses SAML based authentication and uses Okta as the IDP. After logging in, I noticed that the session remains active for many hours even after I log out of ...
0
votes
0answers
47 views

SAML and Multi-factor auth

I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP. If I want to require multi-factor auth, is it a common practice to add multi-factor auth ...
0
votes
0answers
57 views

Security of a web app with AzureAD auth

The company I work for is about to publish a custom web app (hosted in AWS) that authenticates through AzureAD. That way, when someone goes to https://www.mywebap.com it is redirected to AzureAd and, ...
0
votes
0answers
59 views

Can I leverage Shibboleth to avoid recurring metadata exchanges with our customer?

we provide various web services for our customers, leveraging their IdP to have the customers' employees sign in with their company-issued accounts. Sometimes we operate web services for one customer ...
0
votes
1answer
118 views

Could SAML assertion/token be shared or reused between service providers?

SAML noob here, I have an idea implementing permission(authorization) outside of IdP, which effectively become a "Permission Service Provider", so say when an application (another service provider) ...
0
votes
2answers
142 views

SSO Log Users Out Based on IP Address

We would like to implement SAML based SSO for our organization. We do not want employees to be able to access specific accounts outsides of specific hours and IP ranges. (We do not want to setup a VPN ...
0
votes
0answers
566 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
1answer
285 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
0
votes
0answers
897 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...