Shib SP ECP - a few woes

[Giovanni Bajo]

Il giorno 16/ott/2013, alle ore 04:14, "Cantor, Scott" <cantor.2 at osu.edu> ha scritto:

> On 10/15/13 9:54 PM, "Giovanni Bajo" <rasky at develer.com> wrote:
>>>> I've patched out this check. Is this a security issue? Isn't the
>>>> signature enough to validate the IdP response, without having to
>>>> double-check the consistency of the ACS URL?
>>> 
>>> No.
>> 
>> OK, I'll look for the bug on the other side then.
> 
> If you need a justification, the reason is that without the check, a MITM
> between the client and SP can unilaterally get the client to return an
> assertion to it even if the IdP does a check against what's in the
> AuthnRequest. Even signing the request doesn't fix it. With the check, the
> attacker has to get between the client and both the SP and IdP.

Why signing doesn't fix this?

I guess that also assumes that the IdP will return, in its response to the AuthnRequest, the consumer URL extracted from its registered SP metadata rather than whatever URL was sent to it in the AuthnRequest.

On a different topic: I can't find a mapping between the ProviderID in IdpEntry and what URL the AuthnRequest must be sent to; in ecp.py, it is an out-of-band information that is stored in a configuration dictionary at the beginning of the file. That sounds strange, given that a browser (non-ECP) client doesn't need this out-of-band information, since SP will redirect it to the correct URL for authentication.
-- 
Giovanni Bajo   ::  rasky at develer.com
Develer S.r.l.  ::  http://www.develer.com

My Blog: http://giovanni.bajo.it





-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4207 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20131019/9ce45849/attachment.bin