5 ms·

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authenticate across every service that uses SAML 2.0 protocol ..." [0]. > In a golden SAML attack, attackers can gain access to any application that supports SAML authentication (e.g. Azure, AWS, vSphere, etc.) with any privileges they desire and be any user on the targeted application (even one that is non-existent in the application in some cases). Vulnerabilities like this one really do give up the proverbial "keys to the kingdom" and provide an attacker with pretty much everything they need to really ruin your day. Now, this particular attack isn't real practical as it requires things like the "token-signing private key". You don't need domain admin although you do need access to the ADFS account and if an attacker has access to that, well, you're probably already screwed (or well on your way). The point is that SAML is still shiny and new and there will almost certainly be additional flaws found in the future -- flaws which may very well compromise you completely. It's certainly a nice solution to a big problem and, as I said, will make a lot of people's lives easier. I'm just not yet ready to trust it 100%. Edit: To prevent a dozen more "2005!?" comments, I mentioned this in a reply: > True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. The spec has been around for a while. Common deployments -- outside of AWS, MS, RH, etc., haven't (unless I've just been unaware of them). [0]: https://www.cyberark.com/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-cloud-apps/ https://www.cyberark.com/threat-research-blog/golden-saml-ne...

Spooky23 9y ago
You might want to double check those facts. There are probably billions of SAML users. Any significant O365 implementation is using SAML. Any SaaS that allows enterprise login is using SAML. If you do business with Spectrum, you are using SAML when you login. If you interact with most government agencies, you are using SAML. That’s not to say that it does not have risk, but adoption is not an issue!
- 013a 9y ago
  Chase Bank is another one, off the top of my head. SAML is huge. I have no idea where the guy above us is getting is intel.
  - heartbreak 9y ago
    Each of the largest 10 banks in the US use SAML identity providers for their SSO.
timv 9y ago
While there are a thousand reasons to hate SAML, your concerns are not accurate. 1. I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. 2. SAML is very widely used in certain segments. Every SSO product supports SAML, including cloud vendors like Azure, Google and now AWS, and also specialist vendors like Okta and OneLogin. Within the dreaded "enterprise" space, SAML is absolutely the #1 SSO technology in play. 3. The golden SAML attack is a load of crap. It basically says "If you can get the private keys of an identity provider, then you can impersonate that identity provider". Yes, SAML relies on the confidentiality of the signing keys. That "attack" is the equivalent of saying Linux security is broken because if you have the root password you can modify any file.
- jlgaddis 9y ago
  > I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. > SAML is very widely used in certain segments. Perhaps but it's only been in the last few years that I've been hearing about it, mostly WRT the cloud vendors (AWS, specifically). > The golden SAML attack is a load of crap. Yeah, I think I mentioned it isn't very practical. To me, though, this seems like just the unexpected kind of thing that, some day down the road, is going to come back and bite you in the ass. That is, some major issue in some piece of infrastructure that is overlooked, forgotten about, or taken for granted (e.g. heartbleed or similar), that suddenly causes everybody to drop everything and react immediately to fix it.
  - Spooky23 9y ago
    It’s new if you’re not informed about identity as a technology area. Some people in that space consider SAML2 to be outdated! The beauty of a federated identity system is that you keep your credentials away from business partners. If you were a corporate customer of Dropbox relying on them to host your identity, you were kind of fucked when they had an account breach. If you used federated identity, Dropbox never had access to your account credentials. Federated identity also lets you control posture and control access better. Perhaps your email system requires multi-factor auth, but your time card system does not, unless you are approving expenses. You can build that “step up” to multi factor auth on your servers, and use a single MFA credential to do so.
jdhawk 9y ago
SAML 2.0 was finalized in 2005, right? Not saying that means it doesn't have attack vectors, but "relatively new"?
tootie 9y ago
New? 2.0 was ratified in 2005. It's very widely adopted in enterprises. All the big SSO vendors (onelogin, okta, auth0) suppprt it.
xenophonf 9y ago
There's a lot of FUD here, starting with SAML being new. SAML 1.0 was ratified in 2002, and SAML 2.0 was ratified in 2005. Compare that to OAuth, with version 1.0 published by IETF in 2010 and version 2.0 in 2012. Likewise, there are multiple, mature SAML implementations including the open source Shibboleth project, which started in 2000, and SimpleSAMLphp, which started in 2007. I consider Shibboleth the gold standard, against which I measure all SAML implementations. In just the global research and higher educational community (eduGAIN), there are currently 2588 SAML identity providers and 1792 SAML service providers. > Now, this [golden SAML] attack isn't real practical as it requires things like the "token-signing private key". It isn't a flaw in the SAML protocol. If an attacker compromises your IAM infrastructure, be that a domain controller, directory server, KDC, IdP, or OP, they can impersonate your users.
timv 9y ago
> unless I've just been unaware of them Is there a reason you would expect to be aware of them? Is this a field that you work in? Your experience doesn't align with those of us who work in the application security and identity management space, yet you seem to be speaking so confidently about it.
nl 9y ago
I'd imagine every single Fortune 500 company uses SAML. I'd be surprised if many in the Fortune 5000 didn't use it. Sailpoint (a large enterprise SSO/SAML vendor) IPOed at $1B in early November. I think they are probably smaller than Ping Identity. Don't use SAML if you don't have to (it's horrible to program!). But it is very widely adopted.
- cratermoon 9y ago
  Many large universities (ones that operate like enterprise-sized companies) also use SAML for SSO within and across institutions.

Spooky23 9y ago

You might want to double check those facts. There are probably billions of SAML users. Any significant O365 implementation is using SAML. Any SaaS that allows enterprise login is using SAML. If you do business with Spectrum, you are using SAML when you login. If you interact with most government agencies, you are using SAML. That’s not to say that it does not have risk, but adoption is not an issue!

013a 9y ago
Chase Bank is another one, off the top of my head. SAML is huge. I have no idea where the guy above us is getting is intel.
- heartbreak 9y ago
  Each of the largest 10 banks in the US use SAML identity providers for their SSO.

timv 9y ago

While there are a thousand reasons to hate SAML, your concerns are not accurate. 1. I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. 2. SAML is very widely used in certain segments. Every SSO product supports SAML, including cloud vendors like Azure, Google and now AWS, and also specialist vendors like Okta and OneLogin. Within the dreaded "enterprise" space, SAML is absolutely the #1 SSO technology in play. 3. The golden SAML attack is a load of crap. It basically says "If you can get the private keys of an identity provider, then you can impersonate that identity provider". Yes, SAML relies on the confidentiality of the signing keys. That "attack" is the equivalent of saying Linux security is broken because if you have the root password you can modify any file.

jlgaddis 9y ago
> I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. > SAML is very widely used in certain segments. Perhaps but it's only been in the last few years that I've been hearing about it, mostly WRT the cloud vendors (AWS, specifically). > The golden SAML attack is a load of crap. Yeah, I think I mentioned it isn't very practical. To me, though, this seems like just the unexpected kind of thing that, some day down the road, is going to come back and bite you in the ass. That is, some major issue in some piece of infrastructure that is overlooked, forgotten about, or taken for granted (e.g. heartbleed or similar), that suddenly causes everybody to drop everything and react immediately to fix it.
- Spooky23 9y ago
  It’s new if you’re not informed about identity as a technology area. Some people in that space consider SAML2 to be outdated! The beauty of a federated identity system is that you keep your credentials away from business partners. If you were a corporate customer of Dropbox relying on them to host your identity, you were kind of fucked when they had an account breach. If you used federated identity, Dropbox never had access to your account credentials. Federated identity also lets you control posture and control access better. Perhaps your email system requires multi-factor auth, but your time card system does not, unless you are approving expenses. You can build that “step up” to multi factor auth on your servers, and use a single MFA credential to do so.

jdhawk 9y ago

SAML 2.0 was finalized in 2005, right? Not saying that means it doesn't have attack vectors, but "relatively new"?

tootie 9y ago

New? 2.0 was ratified in 2005. It's very widely adopted in enterprises. All the big SSO vendors (onelogin, okta, auth0) suppprt it.

xenophonf 9y ago

There's a lot of FUD here, starting with SAML being new. SAML 1.0 was ratified in 2002, and SAML 2.0 was ratified in 2005. Compare that to OAuth, with version 1.0 published by IETF in 2010 and version 2.0 in 2012. Likewise, there are multiple, mature SAML implementations including the open source Shibboleth project, which started in 2000, and SimpleSAMLphp, which started in 2007. I consider Shibboleth the gold standard, against which I measure all SAML implementations. In just the global research and higher educational community (eduGAIN), there are currently 2588 SAML identity providers and 1792 SAML service providers. > Now, this [golden SAML] attack isn't real practical as it requires things like the "token-signing private key". It isn't a flaw in the SAML protocol. If an attacker compromises your IAM infrastructure, be that a domain controller, directory server, KDC, IdP, or OP, they can impersonate your users.

timv 9y ago

> unless I've just been unaware of them Is there a reason you would expect to be aware of them? Is this a field that you work in? Your experience doesn't align with those of us who work in the application security and identity management space, yet you seem to be speaking so confidently about it.

nl 9y ago

I'd imagine every single Fortune 500 company uses SAML. I'd be surprised if many in the Fortune 5000 didn't use it. Sailpoint (a large enterprise SSO/SAML vendor) IPOed at $1B in early November. I think they are probably smaller than Ping Identity. Don't use SAML if you don't have to (it's horrible to program!). But it is very widely adopted.

cratermoon 9y ago
Many large universities (ones that operate like enterprise-sized companies) also use SAML for SSO within and across institutions.