SAML security question

[Marc Boorshtein]

The post is going trough the user's browser.  if someone owns the browser
(or the user knows how to use common browser debugging tools like tamper)
then they can tamper the http post parameter.  this is why you sign
messages, so you know the messages weren't tampered with.

Marc


On Thu, Apr 11, 2013 at 7:26 PM, Peter Spiro <pspiro at castlighthealth.com>wrote:

>  Hello SAML mavens,
>
>  I have a SAML security question.
>
>  We're a SP supporting IdP-initiated SSO.  We have an IdP who would like
> to send signed SAML responses but convey the user-identifying data as
> additional https POST parameters rather than including this information
> within the signed message.
>
>  The IdP feels this would be secure.  To me it seems inherently insecure
> because the identifying information wouldn't be signed, but I'm
> hard-pressed to imagine a scenario where an attacker could take advantage
> of it.
>
>  Can anyone tell me whether this would be secure, and why?  Any informed
> opinions would be greatly appreciated!
>
>  (Apologies if this question isn't appropriate for this forum, in which
> case I'd appreciate recommendations for where to post it.)
>
>  Thanks,
> Peter
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130411/52b932d3/attachment.html