SAML Spoofing

[Cantor, Scott]

On 7/17/14, 1:43 PM, "Schwoerer, Brad" <schwoerb at uww.edu> wrote:

>I was wondering if anyone else was seeing jesterscourt.cc trying to spoof
>their IdP.

Where did you obtain that log? That would have to come from a system that
believes it's hostname is jesterscourt. So in effect you'd have to access
the logs of the miscreant. Sort of.

You have a request generated from an SP that's meant to go to idp.uww.edu,
but somehow it ends up at a different location. Is that a DNS attack?
Wouldn't that trigger a certificate warning also?

-- Scott