Store IdP in SP session before authentication?

[Lukas Hämmerle]

On 30.10.18 17:24, Cantor, Scott wrote:
> On 10/30/18, 12:21 PM, "dev on behalf of Lukas Hämmerle"
> <dev-bounces at shibboleth.net on behalf of lukas.haemmerle at switch.ch>
> wrote:
> 
>> What do you mean by "whatever protection" in this case?
> 
> I'm saying whatever benefit they're seeking doesn't actually matter
> if you can send it an unsolicited response because whatever "attack"
> somebody is trying to pull off (presumably a XSRF attempt) is still
> going to be possible as long as the attacker doesn't start at the SP
> and allow it to store off any request state for that login.

Thanks for your clarifications. Makes perfectly sense.


>> I'm not sure what SSP supports in this regard but it seems to block
>> an assertions by default if they come from an IdP that it did not
>> expect.
> 
> If I just send it a response from an IdP without letting it make a
> request first, does it block that? 

Yes, SSP apparently accepts unsolicited responses by default.


Best Regards
Lukas


-- 
SWITCH
Lukas Hämmerle, Trust & Identity
GÉANT Project Task Leader of
eduGAIN Service Development - Research and Service Providers
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch