The problem with IDP initiated SSO

[Cantor, Scott]

On 12/23/14, 6:48 PM, "federator" <wpadmin at identiainc.com> wrote:
>
>Despite of having all the SPs info, the front page doesn't have to 
>display all the SPs.

Which means the rest by definition can't rely on IdP initiated SSO.

>> It also precludes deep linking, and there's a word for federated
>> applications that don't support deep linking: broken. Breaking the
>> addressability property of thw web is about as cardinal a sin as you can
>> commit.
>
>We are all sinful in front of God :).  Anyhow, I see this is just an 
>implementation issue.

It's not. It's unimplementable.

>I would be very interested in seeing the papers.  Could you provide some
>references?

Not without some digging.

>I guess the initial question was whether IdP initiated SSO would have a 
>higher vulnerability than SP-initiated SSO.  Apparently if the 
>vulnerability exists, it could happened to SP-initiated SSO as well, or 
>both have the same possibility of getting attacked, or not?

No, if you block IdP-initiated SSO as an SP, you block that particular 
attack.

-- Scott