ExternalAuth

[Nick Amon]

Thanks for the replies Scott.

Since the IdP and the External Auth Component reside on the same host and both have access to the shared local database, as long as the incoming request to the Idp Authentication engine has a valid PHP session ID found in the database, then I know the request was authenticated successfully.  Granted someone can steal the session ID from a valid user and reuse it but the same can be said of the session ID used by the session management component in the Idp.

Thanks

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 26, 2013 9:53 AM
To: Shib Users
Subject: Re: ExternalAuth

On 12/24/13, 4:28 PM, "Nick Amon" <namon at xceedium.com> wrote:
>
>If there is no session ID cookie, or the session is not found in the 
>local database, the PHPAuthEngineServletProxy redirects the user to the 
>PHP AuthEngine for authentication.  After the PHPAuthEngine has 
>successfully authenticated the user and set the PHP session ID cookie, 
>it redirects the user back to the PHPAuthEngineServletProxy, which 
>verifies that session ID cookie against the database and forwards 
>control back to the AuthEngine.
>
>I have implemented this and seems to function fairly well.  I don't see 
>any apparent vulnerabilities in this design.

I don't see how you expect that final transfer back to be secure. Without more information, that seems like a vulnerability.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net