how to get SAML Response to backend application protected by SP

[Roman CHRENKO]

Thank you.
I agree with you that it is big security risk.
I looked at SAML specifications (core and security considerations) and there are strict statements about that which prohibit such design
- core spec: definition of attribute "Destination";
- security considerations spec: search for "AudienceRestrictionType" and mainly "Recipient attribute".
In all of these elements in SAML Response from IDP we have our application domain name (Recipient="http://{SP_FQDN}.{domainName}/Shibboleth.sso/SAML2/POST").

The problem is that backend application have to send SAMLResponse from IDP (issued to real person) to the STS service to get STS token which is used for getting services from other backend applications.
This is requirement of the STS service (which is provided by the same legal subject as IDP). They trust only to the tokens issued by themselves.
As I undestand SAML specifications well, STS service violate the standards because they accept tokens issued to our application domain (and it is not relevant if it is the same legal subject as IDP). Is it right?

Best regards,
Roman




-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, September 6, 2016 3:36 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: how to get SAML Response to backend application protected by SP

> * Roman CHRENKO <Roman_CHRENKO at tempest.sk> [2016-09-06 15:12]:
> > I would like to ask if it is possible to send the whole 
> > <saml2:Response> from SP to the backend application.
> 
> I believe this is not possible, no.

It is not. There should never be any reason to do so, it would indicate a fundamental design flaw.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net