how to get SAML Response to backend application protected by SP

[Cantor, Scott]

On 9/7/16 4:58 AM, Roman CHRENKO wrote:
> I agree with you that it is big security risk.

No, I didn't say it was a risk in that sense, I just said it was a
design flaw. You should never need access to the response, only the
assertion (the content of the response). You can certainly get access to
the assertion.

If you mean that there are rules about taking the response and then
turning around and sending it elsewhere, I certainly agree there, and
you shouldn't in general be able to make that work unless the other
system is implemented incorrectly.

> The problem is that backend application have to send SAMLResponse
> from IDP (issued to real person) to the STS service to get STS
> token which is used for getting services from other backend applications.

No, that would be incorrectly implemented. You need the *assertion*, not
the response. You can get the assertion, and the wiki documents that
callback interface.

> This is requirement of the STS service (which is provided by the same
> legal subject as IDP). They trust only to the tokens issued by themselves.

Sure.

> As I undestand SAML specifications well, STS service violate the standards
> because they accept tokens issued to our application domain (and it is not
> relevant if it is the same legal subject as IDP). Is it right?

Well, let's toss aside the Response thing. That's just wrong. If you
mean the Assertion, it is not uncommon for people to implement that kind
of delegated turn-around incorrectly. I would never allow something that
broken to tbe deployed, but I don't have any say in what others do of
course.

If you're asking if SAML has all the pieces needed to correctly decorate
the assertions so that the STS can implement a proper eval of the token
and do its job, absolutely. We do that for our delegation code.

-- Scott