idp v3 - unsolicited sso failing

[Marc Boorshtein]

>
>
>
> The question comes down to what the point of requiring signed
> authentication requests is in the first place. The only reason to have
> signed authentication requests is to allow you to verify the source of the
> request. IdP-initiated SSO requests can't have their source verified.
> Allowing unsolicited authentication when signing is required just seems
> nonsensical.
>
>
How does not having a signature for unsolicited sso (aka IdP Initiated SSO)
hurt from a security perspective?  All you are doing is verifying the
source of the link.  If you go to my.bad.site.com and I have a backchannel
request (say an iframe or an ajax request) that starts the SSO process in
the background (assuming of course the browser allows it, which in most
cases it wont) what is the difference between that initial URL being for
the SP that then sends a redirect to the idp with a signed request?  Either
the XSS rules in the browser will stop both cases or will let both cases
through and in either scenario the IdP will present the user with the login
process.  What security are you buying?



> If you don't care how an authentication request was initiated, then you
> shouldn't be requiring request signing.
>
> What's the use case (other than broken implementations) where it's
> relevant to require signing of authentication requests but it's okay to
> initiate IdP SSO from completely unknown sources?
>

As Scott states in his response, the use case of overriding metadata is
another use cases where signing the request is needed.  If you are using
all the defaults that are in your (presumably already signed) metadata,
where is there any additional securityby requiring a signed authnrequest
during idp initiated sso?  Now if you allow the defaults to be overridden
(ie a new destination to generate a DDoS attack) from an http request
parameter that isn't signed, you have a problem (and yes some vendors will
let you do this).


PS: I do plan on creating that feature request, just haven't gotten there
yet.

Thanks
Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150317/a6595577/attachment-0001.html