Q in SP config and DS URL

[Peter Schober]

* Mike Manske <michael.manske at ligo.org> [2016-02-25 19:50]:
> Seems like a hole to me. Is it assumed the target URL is running under a
> known SP?
> 
> We are thinking about central DS that many SPs use.

Well, obviously you want to trust the party running the central DS.
Assuming SAML2 a DS will send the browser back to the SAML SP and that
then initiates SSO with the chosen (or fake, for that matter) SAML
IDP. If the SP didn't trust that IDP (via SAML Metadata, ideally
signed by a Trusted Third Party) it would abort the transaction, i.e.,
it wouldn't send you on to the fake IDP.
Of course noone said the evil DS would be speaking SAMLDS protocol, so
any website can redirect any user agent to any other site, of course,
including a fake DS that would redirect you to a fake IDP that looked
like your own SAML IDP.
-peter