IdP Unsolicited SSO & endpoint checking

[Cantor, Scott]

> We have a vendor that wants to use our IdP for authentication. It requires us
> using the unsolicited sso feature of the idp. They do however, have a
> dynamic ACS url, and there’s no way we could list of all of them in their
> metadata. I know that when going through ‘normal’ SAML flow you can
> disable endpoint checking on the idp side if the request is signed from the sp,
> but is there any way to achieve similar functionality using the unsolicited sso
> endpoint? Currently they pass in their ACS url via the ‘shire’ parameter but
> since it’s dynamically generated it won’t be found in their metadata.

There is no way to do it without changing code, other than by mocking up a signed request signed with your own key, essentially.

> Although, this feels like a giant security hole to me so perhaps the better
> question is how would you go about supporting an sp that requires use of
> the unsolicted sso endpoint but also has a dynamic ACS url. The actual URL
> itself stays the same but the query parameters change.

ACS URLs aren't allowed to do that, so that's why it doesn't work.

It's a security hole in the sense that obviously there are people who believe it matters and some people don't, and the people that designed SAML 2 aligned with the first view. It can't really be implemented as an exception since if you allow for any endpoint, then all you do to bypass checking is to identify yourself as that SP. So there's no way to just "exempt" the check for one SP, it's basically all or nothing.

-- Scott