Wildcard for HOST element in RequestMap

[Cantor, Scott]

On 8/14/19, 8:00 AM, "dev on behalf of Amit Thukral" <dev-bounces at shibboleth.net on behalf of amit.thukral403 at gmail.com> wrote:

> For native SPs, applications configuration is picked up from RequestMapper element from shibboleth2.xml

Not on Apache unless you ignore all of the documentation and warnings about it.

> This creates an issue where a possible attack vector where a nefarious user can update their local system’s host-file to
> use a custom domain OR simply navigate to the IP address of the https://<host-ip-address>/<url>. Either of these
> options will allow for the application match NOT to be met in shibboleth2.xml and thus, the SAML authentication
> requirement would be skipped entirely.

No, it doesn't. On Apache you set UseCanonicalName, and on IIS the name is explicitly set in the configuration.

> Had RequestMap element supported, the wildcard in the Host match

It does, HostRegex.

-- Scott