web-based-single-sign-on-and-the-dangers-of-saml-xml

[Bryan E. Wooten]

http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml
Is this really a problem? Or does it require a compromised IDP? Or can anybody send the nefarious SAML XML to the SP?

-Bryan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131210/d5b4954e/attachment.html