web-based-single-sign-on-and-the-dangers-of-saml-xml

[Cantor, Scott]

On 12/10/13, 4:20 PM, "Bryan E. Wooten" <bryan.wooten at utah.edu> wrote:

>http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-t
>he-dangers-of-saml-xml
>Is this really a problem? Or does it require a compromised IDP? Or can
>anybody send the nefarious SAML XML to the SP?

Neither the Shibboleth IdP nor the SP are affected by the issue.

There were reasons why the OpenSAML library didn't apply certain settings
by default, primarily parser independence. There are no portable ways in
JAXP to prevent many attacks and the trade off in most cases is to keep
libraries portable and solve problems in the actual application, the IdP
itself.

You should always be wary of anybody implementing security themselves,
whether or not it's SAML. Chances are they will botch it. That's true
regardless of whether they use OpenSAML or not, and fixing this issue by
implementing some non-portable options by default won't fix that.

-- Scott