11

Reading from http://en.wikipedia.org/wiki/SAML_2.0 , I'm trying to understand the mechanism that guarantees the authenticity of the SAMLResponse sent in step 5 of the process.

The way I understand it, SAML is designed so that the service provider can trust an identity provider for authentication without directly contacting it. However this relies on the user agent re-transmitting a response from the identity provider back to the service provider. It seems to me like a compromised agent could return a fake validated response. How would the service provider validate this without trying to contact the identity provider?

Thanks for your time.

1 Answer 1

15

Good question!

It's similar to the way a bank will verify the signature on a check; they'll compare a few iterations of the individuals on-file signature, to that of the check being cashed - as long as those match, they can trust that the check was signed by the intended individual.

It works the same way with SAML, except the accuracy has to be 100% - the SAML payload is signed with a certificate that is shared and trusted by both the identity provider and service provider.

In order to ensure the authenticity of the response, you need to ensure that the key in which it was signed with matches the key you have stored for that particular trust, and if not, the response shouldn't be accepted as valid.

That's the basic summary, however, if you want more detail, I had this question bookmarked from when I was doing SSO\SAML, and I found it useful in explaining the way this works.

3
  • 1
    So you're saying that prior to a SAML request being made, a certificate must be shared between both providers? Or should the service provider obtain the certificate from the identity provider's site? Commented Mar 13, 2015 at 20:27
  • 2
    Normally the certificates for the SP and IDP is exchanged as a part of SAML Metadata. en.wikipedia.org/wiki/SAML_2.0#SAML_2.0_Metadata Commented Mar 13, 2015 at 21:06
  • @GuillaumeCR I am sure this is the case, I am currently reading up on SAML. In the detailed set up listed here, the certificate is actually being provided to the Service Provider by the Identity Provider. Commented Jul 24, 2018 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.