Sending a user bac to the discovery service from my IDP login page

[Wessel, Keith]

Scott,

No, I was talking about the http referrer header. That's a given (unless someone goes directly to the IDP which would give no referrer), and I can get the entityID.

I was originally thinking of the relaystate param. I thought I could construct the DS URL based on the entityID and the relaystate. Then, I realized the relaystate is where the IDP will post its response. It's not a session initiator URL, of course, unless I'm missing something.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, March 11, 2016 3:00 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Sending a user bac to the discovery service from my IDP login page

> I know referrer can be faked, but since they won't see the IDP's login page
> unless it's accompanied by a valid, signed sqml request. Or is it? I suppose
> IDP-initiated SSO might rain on my parade.

SAML requests are rarely signed. Trying to prevent phishing in that way isn't possible. Signing requests doesn't play any role in XSRF prevention, that requires other tricks that don't require signed requests and are, yes, impossible if IdP-initiated SSO is allowed.

> Can anyone suggest anything more sane/reliable/secure than trying to use
> the referrer? I can get the entityID, obviously, but the return parameter, shy
> of the referrer, seems like an impossibility.

RelayState? Is that what you're talking about?

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net