how to get SAML Response to backend application protected by SP

[Roman CHRENKO]

Thank you.
Roman




-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, September 7, 2016 2:45 PM
To: users at shibboleth.net
Subject: Re: how to get SAML Response to backend application protected by SP

On 9/7/16 4:58 AM, Roman CHRENKO wrote:
> I agree with you that it is big security risk.

No, I didn't say it was a risk in that sense, I just said it was a design flaw. You should never need access to the response, only the assertion (the content of the response). You can certainly get access to the assertion.

If you mean that there are rules about taking the response and then turning around and sending it elsewhere, I certainly agree there, and you shouldn't in general be able to make that work unless the other system is implemented incorrectly.

> The problem is that backend application have to send SAMLResponse from
> IDP (issued to real person) to the STS service to get STS token which
> is used for getting services from other backend applications.

No, that would be incorrectly implemented. You need the *assertion*, not the response. You can get the assertion, and the wiki documents that callback interface.

> This is requirement of the STS service (which is provided by the same
> legal subject as IDP). They trust only to the tokens issued by themselves.

Sure.

> As I undestand SAML specifications well, STS service violate the
> standards because they accept tokens issued to our application domain
> (and it is not relevant if it is the same legal subject as IDP). Is it right?

Well, let's toss aside the Response thing. That's just wrong. If you mean the Assertion, it is not uncommon for people to implement that kind of delegated turn-around incorrectly. I would never allow something that broken to tbe deployed, but I don't have any say in what others do of course.

If you're asking if SAML has all the pieces needed to correctly decorate the assertions so that the STS can implement a proper eval of the token and do its job, absolutely. We do that for our delegation code.

-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net