3 ms·

The vulnerabilities are rather to easy to address as a service provider. It boils down to 1) Use Https, 2) Assert both the request expiration and that you (the

by Salgat 2y ago

The vulnerabilities are rather to easy to address as a service provider. It boils down to 1) Use Https, 2) Assert both the request expiration and that you (the service) are the intended recipient of the request, and 3) Assert the signature (using the metadata you received from the identity provider through a trusted channel). I don't know why people say SAML is complex or hard, it's just you accepting a redirect from an identity provider with an XML payload you validate against.

haswell 2y ago
> I don't know why people say SAML is complex or hard This is a position only people with deep knowledge of SAML can take. Once you understand it, it’s not so bad. But most people - including experienced engineers with decent knowledge of various authentication protocols - find SAML pretty impenetrable, and many of the people implementing it are doing so by following a series of documented procedures that they do not otherwise understand. Source: was a PM for the authentication stack on a big enterprise platform and helped countless customers with their SAML confusion.
- nimish 2y ago
  Anything involving XmlDSig is far, far more complicated than it lets on. I doubt even the SAML experts know it 100%, maybe no one does.
  - jf 2y ago
    The main issue that I have with XmlDSig is that the signatures are stored inside of the document being signed. Because of that, you can’t properly implement the standard without writing enough of an XML parser to do the canonicalization needed to properly compute and verify the hashes used for signatures. In practice, this means you need approximately an entire XML stack just to hash some data, something that is a simple operation otherwise.
jf 2y ago
Remember to make sure your XML parser doesn’t fetch remote DTDs. You’ll also want to make sure that the code which validates the signatures in the SAML assertion reports to you which specific parts were signed. You will also want to validate the schema of the assertion. Also make sure to reject assertions which aren’t signed at all. Don’t forget to store the ID of the assertion to avoid replay attacks.

by Salgat 2y ago

haswell 2y ago

> I don't know why people say SAML is complex or hard This is a position only people with deep knowledge of SAML can take. Once you understand it, it’s not so bad. But most people - including experienced engineers with decent knowledge of various authentication protocols - find SAML pretty impenetrable, and many of the people implementing it are doing so by following a series of documented procedures that they do not otherwise understand. Source: was a PM for the authentication stack on a big enterprise platform and helped countless customers with their SAML confusion.

nimish 2y ago
Anything involving XmlDSig is far, far more complicated than it lets on. I doubt even the SAML experts know it 100%, maybe no one does.
- jf 2y ago
  The main issue that I have with XmlDSig is that the signatures are stored inside of the document being signed. Because of that, you can’t properly implement the standard without writing enough of an XML parser to do the canonicalization needed to properly compute and verify the hashes used for signatures. In practice, this means you need approximately an entire XML stack just to hash some data, something that is a simple operation otherwise.

jf 2y ago

Remember to make sure your XML parser doesn’t fetch remote DTDs. You’ll also want to make sure that the code which validates the signatures in the SAML assertion reports to you which specific parts were signed. You will also want to validate the schema of the assertion. Also make sure to reject assertions which aren’t signed at all. Don’t forget to store the ID of the assertion to avoid replay attacks.