Parsing vendor request/instruction for SAML SSO

[Cantor, Scott]

On 2/3/16, 7:15 PM, "users on behalf of IAM David Bantz" <users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> wrote:



>I read that as requiring the SAML Subject is the principal's email address [or ExternalUserName, adds a later qualification], encoded as a NameId, but with nameid-format:unspecified. Can that be right?

I doubt they care, so the first thing to do is to assume they mean "give us a NameID matching what you want to provision users against", do that, use a suitable Format, and see if it works. Never use "unspecified" unless you have to.

If it's also requiring IdP-initiated SSO, one of the things I'm coming to discover through recent experience is that there's a pretty high likelihood that their implementation will be missing security checks. That's common when they strip things down to that little.

How much you care about that, and what you're willing to do about it, is obviously a local issue, but I'm pretty much down to assuming all SAML code I don't know the source of is broken. That seems to be true more often than not.

The big flag is, do they have an entityID that they know is theirs? If not (i.e., they just hand you the ACS URL), they can't be checking Audience. If they're not checking Audience, they may not be checking Recipient, Destination, or replay. And so on.

-- Scott