SAML Spoofing

[Schwoerer, Brad]

I was wondering if anyone else was seeing jesterscourt.cc trying to spoof their IdP.



Date: Tuesday, July 15, 2014 at 1:28 AM
To: icit-shibTech <icit-shibTech at uww.edu<mailto:icit-shibTech at uww.edu>>
Subject: [SHIB IdP] SAML message intended destination endpoint 'https://idp.uww.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://jesterscourt.cc/idp/profile/SAML2/Redirect/SSO'

________________________________

Log session start time Tue Jul 15 01:28:04 CDT 2014

Date    Thread  Level   Logger  MDC     Message
2014-07-15 01:28:03,971 TP-Processor129 INFO    Shibboleth-Access       JSESSIONID=EA66319349527F97E25DBAFB438D6510, clientIP=66.172.11.245     20140715T062803Z|66.172.11.245|jesterscourt.cc:443|/profile/SAML2/Redirect/SSO|
2014-07-15 01:28:03,975 TP-Processor129 INFO    org.opensaml.ws.message.decoder.BaseMessageDecoder      JSESSIONID=EA66319349527F97E25DBAFB438D6510, clientIP=66.172.11.245     https://shib.courseleaf.com/shibboleth
2014-07-15 01:28:03,975 TP-Processor129 ERROR   org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder     JSESSIONID=EA66319349527F97E25DBAFB438D6510, clientIP=66.172.11.245     SAML message intended destination endpoint 'https://idp.uww.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://jesterscourt.cc/idp/profile/SAML2/Redirect/SSO'