The problem with IDP initiated SSO

[federator]

On 12/22/14 9:47 PM, Cantor, Scott wrote:
> On 12/22/14, 11:28 PM, "Stefan Rasmusson" <rasmusson.stefan at gmail.com>
> wrote:
>
>
>
>> I am trying to understand the problem with using IDP initiated SSO or
>> Unsolicited Responses. I have read the wiki page and I understand that
>> this is a problem for interoperability.
> You can't have interoperability if there is no standard message defined.
Ping has a pretty good graphic illustration on how IdP initiated SSO 
works 
(http://documentation.pingidentity.com/display/PF610/IdP-Initiated+SSO--POST). 
I assume the term "interoperability" refers to SSO.  If that the case, 
as long as all SP's accept the same standard SAML response format, 
interoperability shouldn't be an issue.
>
>> Do any one have a copy of the long version? =) Or maybe som partical
>> example where this could be a problem?
> Show me the format of a message to send any SAML IdP to cause this flow to
> happen. You can't. If you don't see that that's a problem, I don't know
> what else I can really tell you.
>
> It's also a XSRF attack by definition.
XSRF can occur anyhow when cookies are used for maintaining sessions. 
Better to use HTTPS for prevention...
>
> -- Scott
>