Hacking SHIB_USERID

[Nate Klingenstein]

Murthy,

SHIB_USERID is not passed from the IdP to the SP.  The IdP issues a SAML assertion, which in most cases is a bearer token, which is used and processed by the SP.  It’s kinda analogous to the IdP making a session cookie on the SP’s behalf and giving it to the user, except with security parameters built in.  Once the SP receives the assertion, it will map some field in there to SHIB_USERID based on your configuration, particularly attribute-map.xml.

Whether the security parameters built into the assertion satisfy your needs depends on your needs, of course.  In general, if the session is going to be persisted using a cookie, that’s the weakest link in the system.  If not, there are ways you can use SAML in a more secure way, generally by binding the SAML token to the user agent somehow.

SHIB_USERID is a header variable and inherent to the same vulnerabilities as all header variables, much of which will depend on the web environment in which you’re operating.  Environment variables are preferred to rule out all doubt, but headers are not the lowest lying fruit in most instances either.

This document should still be pretty useful, though there’s almost certainly errata and it doesn’t cover everything.

http://docs.oasis-open.org/security/saml/v2.0/saml-sec-consider-2.0-os.pdf

Take care,
Nate.

On Sep 11, 2015, at 11:13 AM, Murthy Nunna <mnunna at fnal.gov<mailto:mnunna at fnal.gov>> wrote:

Good Afternoon,

We are thinking of implementing Shibboleth in our web server… We are successful in obtaining SHIB_USERID and basing our access on this.

How safe is SHIB_USERID (that is passed from idp to SP) from getting hacked? Can user1 get authenticated by Shibboleth and then present as user2 and proceed with access.

Our environment is :   browser<->WebServer with Sibboleth used for authentication.

Browser is typically user pcs windows/mac and Web Server is on Linux

Thanks,
Murthy
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150911/8fd84593/attachment.html>