IdP custom handling for throttling misbehaving looping SPs

[Cantor, Scott E.]

On 8/9/11 2:05 PM, "Russell Beall" <beall at usc.edu> wrote:

>Has anyone implemented any custom code which can detect and throttle, or
>error out, occurrences of an SP which is misconfigured and starts looping?

Legacy requests are usually shortcircuited by replay detection (now
anyway, not prior to 2.3). Not sure there's any way to do that for SAML 2
without explicitly adding features.

If it's happening at all, the web site is misconfigured, so making sure
the resulting message actually blames them is helpful.

The old IdP would block this using a cookie technique that would
generalize to SAML 2, so could be added as a feature, or probably
implemented within custom login handler code, but it does use up a lot of
cookie space.

-- Scott