SAML Spoofing

[Cantor, Scott]

On 7/17/14, 1:59 PM, "Schwoerer, Brad" <schwoerb at uww.edu> wrote:

>It got generated out of the IDP logs on my system.  I figure the person is
>trying to spoof my IDP and made a mistake somewhere in crafting the SAML
>message and that it got accidently sent to my IDP instead of theirs.

Well, the problem is the message says that the XML content included a
Destination attribute pointing to your URL, not the weird one. The weird
one is coming from the half that is derived from the local web server's
config. Or at least that's how I read the code. It's confusing when it's
logging apple != apple, you're never sure which apple is which.

>Maybe I am reading the error message wrong.  It didn¹t look correct to me
>and thought I would put it infront of eyes that understand some of that
>better than me.

I looked at the code to see which was which, and I'm pretty sure the
second URL is coming from the servlet.getRequestURL call underneath, while
the first one comes from the Destination in the message.

So make of that what you will.

-- Scott