web-based-single-sign-on-and-the-dangers-of-saml-xml

[Bryan E. Wooten]

Thanks for the reply Scott.

Just curious. Doesn't the Shib SP use OpenSAML? How was this issue
avoided? The whole topic of XML exploits is new to me.

Regards,

bryan

On 12/10/13 2:49 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 12/10/13, 4:20 PM, "Bryan E. Wooten" <bryan.wooten at utah.edu> wrote:
>
>>http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-
>>t
>>he-dangers-of-saml-xml
>>Is this really a problem? Or does it require a compromised IDP? Or can
>>anybody send the nefarious SAML XML to the SP?
>
>Neither the Shibboleth IdP nor the SP are affected by the issue.
>
>There were reasons why the OpenSAML library didn't apply certain settings
>by default, primarily parser independence. There are no portable ways in
>JAXP to prevent many attacks and the trade off in most cases is to keep
>libraries portable and solve problems in the actual application, the IdP
>itself.
>
>You should always be wary of anybody implementing security themselves,
>whether or not it's SAML. Chances are they will botch it. That's true
>regardless of whether they use OpenSAML or not, and fixing this issue by
>implementing some non-portable options by default won't fix that.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net