The problem with IDP initiated SSO

[Cantor, Scott]

On 12/22/14, 11:28 PM, "Stefan Rasmusson" <rasmusson.stefan at gmail.com> 
wrote:



>I am trying to understand the problem with using IDP initiated SSO or 
>Unsolicited Responses. I have read the wiki page and I understand that 
>this is a problem for interoperability.

You can't have interoperability if there is no standard message defined.

>Do any one have a copy of the long version? =) Or maybe som partical 
>example where this could be a problem?

Show me the format of a message to send any SAML IdP to cause this flow to 
happen. You can't. If you don't see that that's a problem, I don't know 
what else I can really tell you.

It's also a XSRF attack by definition.

-- Scott