Docusign SSO

[Cantor, Scott]

> Do you believe metadata exchange over TLS as insecure?

Yes, both because TLS isn't implemented correctly and because that's still self assertion with no notion of who actually is operating that endpoint. There is no connection between domain validation of a web site and actual organizational identity. Any student can host information on an osu.edu domain. Knowing it's the right domain is the hard part, and if you have to delegate that question, delegating the metadata hosting isn't much more work.

As Peter said, there's also the naming constraint issue. Do you properly ensure that only the metadata for the entityID matching that URL is loaded? Maybe you do, but a lot of software won't know to do that.

> In addition I don't see much point in adding trusted 3rd parties to sign
> and host metadata given the metadata retrieved from the entity can be
> signed and independently verified.

Third party hosting of metadata or metadata query services is a simpler workflow than requiring every deployment to properly host their own. And in the case you do want TLS as the trust model, that's much more secure as a single endpoint managed well than expecting deployers who can't even maintain their software to do it properly.

-- Scott