3 ms·
Until all of these old-ass systems that finally got to SAML move to a new SSO architecture this could largely be mitigated by using the HTTP artifact binding in
by jcims 5y ago
Until all of these old-ass systems that finally got to SAML move to a new SSO architecture this could largely be mitigated by using the HTTP artifact binding instead of POST or redirect.
Getting rid of SAML will be like getting rid of SMS 2FA.
- yrro 5y agoThis is because with the HTTP artifact binding, the SP (relying party) gets the claims directly from the IdP, and can therefore trust that the contents aren't malicious, right? It would therefore be comparable to OpenID Connect's authorization code flow.
- mooreds 5y agoFor others who may be unfamiliar with HTTP artifact binding, I found this blog post useful: https://everything1know.wordpress.com/2019/02/19/saml-2-0-artifact-binding/ https://everything1know.wordpress.com/2019/02/19/saml-2-0-ar...